I’ve tweaked the protection settings for the master branch to be a little more restrictive than they were before:
In practice the last checkbox there means that even when you have push access to the syncthing/syncthing repository, you will not get a merge button on pull requests:
You can however still ask st-review to do it, which is the intended way. St-review performs a couple of extra checks (the commit message format, for example) that are not possible to enforce in another way (on GitHub).
Let me know if this screws up your workflow somehow.