ci: watch the silero VAD model and dash.js's vtt.js for new releases (U1)

[Nawid3333]

U1 from REVIEW-2026-09-30.md: a watcher for the vendored files nothing watched, in the shape the other update workflows have (daily, assigned + @mention, closes itself).

vendored-updates.yml (daily, 06:45 UTC), two jobs:

• The silero VAD model:
  • A newer snakers4/silero-vad release whose silero_vad_half.onnx has other bytes gets a pull request "Vendored model update: silero-vad " on vendored/silero-vad-<tag>. It replaces the model and moves TAG and SHA256 in tools/verify-vad.mjs, and CI is dispatched on it, because this token's push starts none. The voice detector's reference e2e decides.
  • If the model isn't at its path at the new tag, an issue says so instead: "Silero VAD : the model file moved".
  • The token is passed per git command; .git/config never holds it, the same pattern as ci(security): no token left in .git/config, no shared cache where the AMO keys are, zizmor #100.
• vtt.js: a dash.js release that changes contrib/videojs-vtt.js/vtt.js gets an issue, "vtt.js changed in dash.js ", with the changed-line count and a compare link. A person moves the tag in tools/verify-vtt.mjs and runs verify:vtt, since FastStream's changes may need re-deriving.
• Shared rules:
  • Nothing is raised twice: closing an item skips that release.
  • Each item closes itself once its pin reaches the release.
  • A newer release's item closes the older ones.
  • Each job reports its own failure.
• update-prs.yml is unchanged: it leaves branches it doesn't know to the owner, and the PR is assigned to you anyway.
• libsamplerate, the third file U1 listed, is gone with feat(save): copy streams into the MP4 as they are; the re-encoder, libsamplerate and jswebm are gone #101.

Today it would raise nothing. silero-vad v6.2.3 and dash.js v5.2.1 publish the same bytes as the pins, v6.2.1 and v5.1.0. I checked both by hash.

Tests: tests/workflows/vendored-updates.test.sh, 10 scenarios, 41 checks.

• The model PR: a real git pushes to a local bare origin. The test checks one commit with exactly the model and the pin changed, the PR, the CI dispatch, older and taken PRs closed, a person's PR untouched, and no token in .git/config.
• Other model cases: same bytes; model gone (issue); raised before (nothing fetched); pin reached (closes); a tag that is no version (refused).
• vtt.js: changed (issue, with older issues closed); same file; gone; raised before.
• Each of 7 rules, undone, fails it.
• actionlint is clean, and zizmor with ci(security): no token left in .git/config, no shared cache where the AMO keys are, zizmor #100's config finds nothing.

Ships nothing.

🤖 Generated with Claude Code