Fix upstream tracker workflow to handle Actions variable permission errors gracefully

The workflow was failing when trying to update the UPSTREAM_LAST_COMMIT
Actions variable due to insufficient permissions (403 error). This commit
makes the update step non-fatal by:

1. Adding continue-on-error: true to prevent workflow failure
2. Restructuring the update logic to provide clear warnings
3. Exiting with status 1 on permission error (caught by continue-on-error)

The workflow will now succeed even if it cannot persist state between runs.
When permissions are insufficient, it will emit warnings explaining:
- The permission issue
- That the workflow will use current HEAD as baseline
- That a repository admin needs to configure Actions permissions

This allows the workflow to remain functional for change detection and issue
creation, even without the ability to persist the last checked commit.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: jbachorik

.github/workflows/upstream-tracker.yml

@@ -120,18 +120,27 @@ jobs:
 
       - name: Update last checked commit
         if: success() && steps.clone-upstream.outcome == 'success'
+        continue-on-error: true
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          gh api \
+          # Try to update the variable, but don't fail the workflow if we can't
+          if gh api \
             --method PATCH \
             repos/${{ github.repository }}/actions/variables/UPSTREAM_LAST_COMMIT \
             -f value="${UPSTREAM_HEAD}" \
-            2>/dev/null || \
-          gh api \
+            2>/dev/null; then
+            echo "Updated last checked commit to ${UPSTREAM_HEAD}"
+          elif gh api \
             --method POST \
             repos/${{ github.repository }}/actions/variables \
             -f name=UPSTREAM_LAST_COMMIT \
-            -f value="${UPSTREAM_HEAD}"
-
-          echo "Updated last checked commit to ${UPSTREAM_HEAD}"
+            -f value="${UPSTREAM_HEAD}" \
+            2>/dev/null; then
+            echo "Created last checked commit variable with value ${UPSTREAM_HEAD}"
+          else
+            echo "::warning::Unable to persist last checked commit. This may be due to insufficient repository Actions permissions."
+            echo "::warning::The workflow will continue to work but will always compare from the current HEAD as baseline."
+            echo "::warning::To enable state persistence, a repository admin needs to configure Actions permissions."
+            exit 1
+          fi