ci: restrict Dependabot auto-merge to classified minor and patch updates

[dinakarjs]

What

Supplement to #251, based directly on e2aecd57df027023ef3c1fec17ac72ae8995a5e0. Add synchronize, verified Dependabot metadata and a gate requiring every dependency in a nonempty group to be a classified semver minor or patch update. Major, unknown and malformed metadata stays manual. The merge command matches the event head SHA.

Why

The current proposal queues all Dependabot PRs, including majors, and does not rerun when Dependabot updates a PR. Ports the safeguards from weight-custody-manifest#196, integrations#324, agent-manifest#505 and cmcp#758 into #251's existing branch. Corrects the pip wording to reflect the existing Python-major ignore policy; Python and Docker update policies are unchanged.

Security impact

Restricts eligibility for enabling native auto-merge. SHA-pinned metadata action keeps default verification enabled; no checkout is added. Existing same-repository/bot checks, permissions and branch approval/check requirements remain. No delegation, channel, attestation, signing or runtime changes.

Test plan

• 43 focused tests passed: 15 new shell/metadata controls, 22 existing release-artifact guards and six container-release guards.
• Full ruff check src/ tests/, ruff format --check src/ tests/ (107 files) and git diff --check passed.
• Full runtime suite, mypy and security scans: require normal CI on ci: group Dependabot minor and patch updates and queue auto-merge #251's combined revision after integration.
• Genuine Dependabot hosted path: validate after integration; this human-authored PR does not exercise that actor path.

Focused checks ran in an isolated pytest/PyYAML environment with --noconftest and this checkout on PYTHONPATH; runtime fixtures were not needed. The installed-package version test was deliberately deselected because no cA2A distribution was installed. One unused asyncio_mode configuration warning reflects the absent asyncio plugin. No dependency installation or lock changes were needed for these synchronous workflow checks.

Bash/jq controls run on Linux to match the Ubuntu auto-merge job; structural checks also run on Windows. Existing CI will collect the tests on #251's combined revision; main-targeted CI does not automatically run for this custom-base PR.

DCO sign-off

• I certify that I wrote or have the right to submit this contribution and agree to the Developer Certificate of Origin.

Signed-off-by: Srinivasa Dinakar Jainti dinakarjs@gmail.com

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AgenTrust Contributor Check.