I would add the following command:

@GrahamCOfBorg build-and-merge foo bar baz

Then, if:

• You are unknown: the command is ignored
• You are a known or trusted user: the builds are queued
• You are a Nixpkgs member (a subset of the known users): a merge job
  is queued

If a merge job is queued, it will contain:

• a "command ID". All build jobs from this command will carry the same
  command ID.
• a list of build jobs triggered to wait for

The merge job will then wait for each build job to complete.

If any return a Failure, the merge job is canceled.

If the PR's status checks fail, the job is canceled.

If any known or trusted user comments:

@GrahamCOfBorg cancel

after the command was issued, the job is canceled.

When all of the jobs complete with Success or "not attempted" (a special
status to indicate the job wasn't possible, like building systemd on
x86_64-darwin) the PR is then merged by OfBorg's user. The merge
commit will indicate who issued the merge command.