Add automated upstream update workflow

update-version.sh bumps the pinned Patchwork release: it fetches the latest
upstream tag, downloads both tar.gz assets, updates versions.sh, the manifest
and the metainfo, then self-validates with check-versions.sh. A daily cron
workflow commits the bump and opens a PR labeled automerge; the CI workflow
builds the Flatpak in the freedesktop-24.08 container and auto-merges the PR
once the checks pass.

README.md

@@ -99,6 +99,27 @@ To bump the Flatpak environment, update `RUNTIME_VERSION` in `versions.sh` (used
 for the freedesktop runtime, SDK and Electron BaseApp — they always move
 together).
 
+## Automated updates
+
+`update-version.sh` performs the app-version bump above automatically: it
+fetches the latest upstream release, downloads both `tar.gz` assets to compute
+their sha256, and updates `versions.sh`, the manifest and the metainfo
+(including the release date). Run it locally with `--dry-run` to preview, or
+plain to apply (requires `curl` and `jq`).
+
+Two GitHub Actions drive the workflow:
+
+- **`.github/workflows/update.yml`** — on a daily schedule (or
+  `workflow_dispatch`) runs `update-version.sh`, commits the bump as
+  `github-actions[bot]`, pushes a branch and opens a PR labeled `automerge`.
+- **`.github/workflows/build.yml`** — on every PR and push to `main` validates
+  the shell scripts and pinned versions, then builds the Flatpak in the
+  `freedesktop-24.08` Flathub CI container (installing the Electron BaseApp
+  first). A `merge` job auto-merges the bump PR with `--squash` once both jobs
+  pass; if the build fails the PR stays open for manual review.
+
+Runtime bumps are never automated — only the app version is.
+
 ## Notes
 
 - **Why `tar.gz` and not the AppImage?** The upstream `tar.gz` assets are the