DEP-S04: Document the merger contract and the Sonar precondition #181

Severity: Low (documentation; operator precondition tracked by AUD-SONAR-REQUIRED) · Epic: DEP · Landing order: 15 of 21 · Blocked by: none

Add docs/contributing/dependency-automation.md stating the merger contract, the per-ecosystem privilege audit result (gomod/pip/npm/actions; which run inside jobs holding privileged tokens) and the D-178 caveat (green on a bot PR excludes Sonar, skipped on dependabot[bot] runs). The required-check set is live branch protection, unreachable from in-tree files (D-177), so no in-tree guard or live probe is built.

Spec: openspec/specs/p5-dep-dependency-automation/spec.md — DEP-S04, REQs REQ-DEP-S04-01; proposed in #166. Gate-wiring rule: openspec/specs/README.md (every new guard, every mode, runs on pull_request in verify).

Operator steps:

• If Sonar is ever made a required check (AUD-SONAR-REQUIRED), disable the merger until a token-bearing analysis exists for bot PRs.

Acceptance (one PR; TDD — failing test first):

• REQ-DEP-S04-01 — doc states contract, audit and D-178 caveat — rg -c 'D-178|AUD-SONAR-REQUIRED' docs/contributing/dependency-automation.md

Done when: every REQ's Verify passes on the PR (or is post-merge with its follow-up issue linked), task check is green, and the gate-wiring rule holds.

Source: spec/oss-quality-signals @ 94be853 (independent review + cold adversarial review, 2026-10-05).