ci: add update-dist workflow to auto-rebuild dist on push

[adityamaru]

The repo has build.yml and verify-build.yml that detect when dist/ is stale, but neither actually rebuilds and commits it. This means every contributor (internal or external) has to remember to run pnpm run build locally and commit the result — and external contributors can't even do that because pnpm install requires BUF_TOKEN for the private Buf registry packages.

This adds a new update-dist.yml workflow that triggers on pushes to non-main branches whenever source files change (src/**, package.json, pnpm-lock.yaml, tsconfig.json). It installs deps with BUF_TOKEN, runs pnpm run build, and if dist/ changed, auto-commits and pushes the update. The paths filter deliberately excludes dist/ so the bot's own commit never re-triggers the workflow.

This only covers branches pushed directly to this repo (internal PRs). Fork PRs still can't auto-rebuild because GITHUB_TOKEN can't push to a fork's branch — for those, the current workflow is to cherry-pick onto an internal branch first. Adding full fork support would require a PAT or GitHub App token, which can be done as a follow-up if needed.

---

View Codesmith session

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}