ci: group Dependabot minor and patch updates and queue auto-merge

[imran-siddique]

69 of the 92 open PRs across agentrust-io are Dependabot's, one per package. This groups minor and patch updates into one PR per ecosystem per week, which is two to four a week per repo.

• .github/dependabot.yml: a catch-all minor/patch group on each pip and github-actions entry, replacing the narrower codeql-action group. Majors still arrive one at a time. Docker digest entries are unchanged.
• .github/workflows/dependabot-auto-merge.yml: runs gh pr merge --auto --squash on Dependabot PRs. It approves nothing. A maintainer still approves the head commit, and gate plus the branch rules still apply. Once that happens and CI is green, GitHub merges without anyone coming back to click.

🤖 Generated with Claude Code

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[carloshvp]

Reviewed exact head e2aecd57df027023ef3c1fec17ac72ae8995a5e0 in an isolated checkout.

Required repository-policy correction: CONTRIBUTING.md, Developer certificate of origin requires a Signed-off-by trailer on every commit. e2aecd57df027023ef3c1fec17ac72ae8995a5e0 have none. Please add the author's DCO sign-off to each commit; the Co-Authored-By trailer does not provide that certification.

Validation: 26 checks against the actual workflow and Dependabot configuration. The eligibility guard admits same-repository dependabot[bot] PRs and rejects human, spoofed-name and fork controls. The workflow checks out no PR content, passes the URL through the environment and only queues squash auto-merge; it grants no approval or administrator bypass. The catch-all groups contain only minor/patch updates; existing schedules, directories, limits, ignore rules and Docker digest/minor policy are unchanged. Actionlint v1.7.12, diff checks and a clean merge simulation passed.

The focused repository OIDC/release-validation checks passed: 13 tests.

Live main-branch rules require independent code-owner/current-push approval, resolved review threads and the maintainer gate; repository auto-merge is enabled. I did not dispatch or claim a live Dependabot merge: the first eligible event still needs operational observation. Only the gate is currently a required status check, so other CI failures still need maintainer attention before approval.

Requesting changes only for the missing required DCO sign-off; I found no blocking defect in the workflow/configuration changes reviewed.