chore: add dependabot automerge workflow

[unional]

Add dependabot automerge workflow for automatic merging of patch and minor dependency updates.

[changeset-bot]

⚠️ No Changeset found

Latest commit: a15a77a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[unional]

Flagging rather than closing — this is your own work, not a dependency PR, so it is your call.

Half of it has been overtaken. .github/workflows/dependabot-automerge.yml is the file #631 deleted, along with automerge-dependabot.yml and .github/mergify.yml, when dependency automation was consolidated onto a single updater. Both of those workflows ran gh pr merge --auto --rebase, which can never succeed here: this repo has allow_rebase_merge: false. That, plus a Mergify rule gating on a safe-update label nothing applies, is why 19 dependency PRs had been sitting unmerged since February 2025.

Dependabot's PR-opening (automated-security-fixes) is now off; its alerts stay on and Renovate consumes them through vulnerabilityAlerts. So a dependabot-automerge workflow no longer has anything to merge.

The other half — the vendored .agents/skills/* and skills-lock.json — is untouched by any of that and still applies cleanly in spirit. If you want it, rebasing onto main and dropping the workflow file is the whole job.

The local checkout was sitting on this branch (ci/dependabot-automerge) when the modernization pass started. It has been left exactly as it was; all work was done on separate branches off main.