Automate the upstream pin bump, derive the task table from source

[gantoine]

Stacked on #125. Review that one first — this PR's base is its branch, so the diff here is only the automation.

Closes the two gaps I flagged in #125. Both are the reason #124 happened, and both would let it happen again.

1. Nothing was moving the pin

scripts/sources.toml claimed it was "bumped automatically by .github/workflows/romm-release-bump.yml". That workflow never existed. The comment described an intent nobody implemented, which is exactly why the pin sat on 5.1.0-beta.2 while upstream shipped 5.2.0, and why every variable added in between went undocumented.

This adds the workflow the comment was already claiming. It:

• polls daily for the latest stable rommapp/romm release
• accepts a romm-release repository_dispatch, so the romm repo can trigger it on publish instead of waiting for the poll
• accepts a manual dispatch with an explicit ref, for pinning a pre-release or rolling back
• regenerates all three snippets, formats them with the prettier version trunk pins (3.5.2, so the bump PR passes its own trunk-check), and opens a PR
• exits quietly when the pin is already current or when a bump branch is already open

One thing worth knowing: the PR is opened with GITHUB_TOKEN, and PRs opened that way don't trigger other workflows, so pr-checks won't run on the bump PR. Rather than leave that as a silent gap, the workflow runs mkdocs build --strict inline before opening. If you'd rather have the full pr-checks suite run, swap GITHUB_TOKEN for a PAT secret and the inline build becomes redundant.

2. The task table was hand-maintained

gen_scheduled_tasks.py hardcoded its list, which is how every scheduled row's env var name came to be invented. It now reads the upstream registry:

Source	Gives
backend/startup.py	which tasks the scheduler init()s
backend/endpoints/tasks.py	which tasks the Tasks page runs by hand
backend/tasks/**.py	each task's title, enabled flag, cron default
env.template	resolves env constants to documented defaults

The important part is the guard: every env var name is resolved through env.template, and a task referencing a constant env.template doesn't define fails the build rather than printing a guess. Anything the AST parser can't resolve fails the same way instead of silently emitting something wrong. The *_INTERVAL_CRON names fixed in #125 could not survive this check.

Task titles now match what Administration → Tasks actually shows, since they come from the same constructor the UI reads. Watchers aren't Task subclasses so they can't be discovered this way, and stay declared, but their env vars go through the same env.template check.

Testing

• Generator output is unchanged in substance from the hand-corrected table in Add ZimaOS install guide, fix stale upstream pin (#124) #125, which is the point: the machine independently reproduces what I verified by hand. Titles and ordering now follow upstream.
• Ran it against the old 5.1.0-beta.2 pin as well: it produces a correct, different table (9 scheduled, 4 manual) rather than erroring, confirming the guard fires on genuinely inconsistent input rather than on any change.
• mkdocs build --strict clean. trunk check clean, including actionlint, yamllint and checkov on the new workflow.

Note for #125

I also pushed a commit there optimizing the ZimaOS PNGs. trunk check runs oxipng and flagged them, so as extracted from the PDF they would have failed that PR's own trunk-check. Lossless, 784K → 692K.

🤖 Generated with Claude Code