Automate updates of trusted tools

1. Run `make update-trusted` somewhere
1. Close any existing automated update PRs that haven't been merged
1. Generate PR (one per toolset, the install automation doesn't work on changes to multiple toolsets in one batch)
1. A usegalaxy.* admin merges the PR if the test build was successful

Or maybe we should only automate the common toolset and each usegalaxy.* admin can set up their own fork to automate their updates.

Start by locating the `make update-trusted` target and reviewing the existing automated update PR process. Determine whether automation should cover the common toolset or support each usegalaxy.* fork, then define how one PR per toolset is generated and how stale PRs and successful test builds are handled. Done means the chosen workflow is documented and operational.

Written by the indexing model from the issue text.