ci(submodules): reuse one rolling branch and PR instead of opening a new PR every 6 hours

The bot pushed a timestamped branch and opened a fresh PR on every scheduled
run, leaving 470+ superseded 'chore: update vendor submodules' PRs open. It now
rebuilds a single chore/update-submodules branch from main, force-pushes it,
and only opens a PR when none is open, so the existing PR refreshes in place.

Co-Authored-By: claude-flow <ruv@ruv.net>

.github/workflows/update-submodules.yml

@@ -50,18 +50,26 @@ jobs:
             git diff --submodule=log -- vendor/ || true
           fi
 
-      - name: Create PR with updates
+      # One rolling branch and at most one open PR. The branch is rebuilt from
+      # main on every run and force-pushed, so an open PR always shows the
+      # latest pointers instead of a new PR piling up every six hours.
+      - name: Create or refresh the update PR
         if: steps.check.outputs.changed == 'true'
         run: |
-          BRANCH="chore/update-submodules-$(date +%Y%m%d-%H%M%S)"
-          git checkout -b "$BRANCH"
+          BRANCH="chore/update-submodules"
+          git checkout -B "$BRANCH"
           git add vendor/
           git commit -m "chore: update vendor submodules to latest upstream"
-          git push origin "$BRANCH"
-          gh pr create \
-            --title "chore: update vendor submodules" \
-            --body "Automated submodule update to the latest upstream commit on each submodule's tracked branch (see \`.gitmodules\`). Review the pointer diff before merging." \
-            --base main \
-            --head "$BRANCH"
+          git push --force origin "$BRANCH"
+          OPEN=$(gh pr list --base main --head "$BRANCH" --state open --json number --jq '.[0].number')
+          if [ -n "$OPEN" ]; then
+            echo "Refreshed existing PR #$OPEN"
+          else
+            gh pr create \
+              --title "chore: update vendor submodules" \
+              --body "Automated submodule update to the latest upstream commit on each submodule's tracked branch (see \`.gitmodules\`). This PR is refreshed in place on every scheduled run. Review the pointer diff before merging." \
+              --base main \
+              --head "$BRANCH"
+          fi
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}