ci: auto-merge minor and patch Dependabot updates #150

Problem

Dependabot pull requests stay open after CI passes (e.g. #146): nothing enables auto-merge, so every update is merged by hand. The other structured-world repositories run a dependabot-auto-merge.yml workflow for this.

Solution

Add the same workflow: on a Dependabot pull request it approves and enables squash auto-merge for semver-minor and semver-patch updates, pinned to the inspected head; a push by anyone else disarms auto-merge. It runs on pull_request_target without checking out pull request code, using the organisation's release App token.

Acceptance criteria

• A minor/patch Dependabot PR merges by itself once the required checks pass.
• A major update is left for manual review.
• A foreign push to a Dependabot branch disarms auto-merge.