feat(dependabot-auto-merge): opt-in major gate

[twistedmelonman]

Advances smartwatermelon/dev-env#120 (phase 1: the release valve for majors).

What changes

New caller input allow_major (boolean, default false). With it on, a single-dependency major bump outside trusted_namespaces merges without a human, but only through a stricter gate than patch/minor:

1. The policy step emits decision=major-gate (one dependency, both versions parse, majors differ).
2. A new step waits until every check on the PR head SHA has finished, required or not, except this workflow's own runs. Any fail or cancel leaves the PR for manual review and names the checks. SKIPPED/NEUTRAL do not block.
3. A new step approves and merges directly with --match-head-commit <sha>. It does not use --auto.

Unchanged: callers that leave the input unset, grouped PRs, unparseable versions, and trusted-namespace majors (they keep the --auto path). The new steps run only on decision=major-gate.

Why not --auto for majors

gh pr merge --auto waits only on required checks. Measured today on main:

Repo	Required on main	Checks on its latest Dependabot PR
projectinsomnia	standards-check	build, netlify-site-checks, 4 Netlify checks, standards-check, auto-merge
amelia-boone	standards-check	Code standards & build (24), netlify-site-checks, 4 Netlify checks, standards-check, auto-merge
claude-config	standards-check, tests	standards-check, tests, auto-merge
github-workflows	standards-check	standards-check, guard-no-checkout

A red build is not required in three of the four repos, so it does not stop --auto. Auto-merge also stays armed across a Dependabot rebase, and the new head is then judged by required checks only. The header comment said --auto merges "only after all status checks pass"; that was wrong and now says required checks only.

How the gate avoids a false "all green"

• Late checks. It waits 120 s, then needs two identical all-finished polls with at least one other check green. On projectinsomnia#195 and amelia-boone#103/fix: warn on too-short sha= marker in Minimize PASS review comment step #104, the last check registered 6–45 s after the PR opened.
• Permissions. The job has no checks: read, and it cannot request one: a called job that requests a permission its caller did not grant fails validation for every caller. On a private repo the check list may come back blank. The gate therefore requires that it can see its own check run, and skips if it cannot. Private-repo opt-in may need a later contract that adds checks: read and updates callers.
• Other exits. If the head moves, the output is unreadable, or 40 minutes pass, the gate skips. Every skip is a ::notice::, never a red check (the dependabot-auto-merge is inert in 29/51 fleet repos: can_approve_pull_request_reviews unset by installer #87 rule). The job gets timeout-minutes: 50.

Open question, not decided here

Security updates bypass Dependabot cooldown. Per GitHub's docs, cooldown applies to version updates only. A security-driven major can open on day 0, and with allow_major: true it merges as soon as every check is green. The workflow cannot tell whether a cooldown elapsed. Also, the docs list semver-major-days as not supported for github-actions; that ecosystem gets only default-days.

Testing

• New tests/test-dependabot-auto-merge.sh (17 cases). It extracts the policy and gate run: blocks with yq and runs them against a stub gh. Four deliberate mutations (self-visibility, allow_major, the two-poll rule, cancel counting) each make it fail.
• bash tests/run-tests.sh: all 8 files pass.
• bash standards/run-standards.sh --repo .: clean.
• actionlint, zizmor, and shellcheck -S info are clean, with no suppressions added.

Release

No tags were moved. Per README "Rollout discipline", pin 2–3 pilots to a new exact tag before moving dependabot-auto-merge-v2. Moving v2 also picks up two comment-only commits already on main (#180, #188). allow_major is an error on any ref that lacks it, so callers can set it only after the tag ships.