DEP-S02: Merge safe Dependabot PRs on a schedule, rebase only, all checks green #182

Severity: High (dependency PRs are the supply-chain path; auto-merge must fail closed) · Epic: DEP · Landing order: 16 of 21 · Blocked by: #180, #170, #167

Add scheduled (+ workflow_dispatch) dependabot-merge.yaml: no PR/pull_request_target/workflow_run trigger, no checkout. Per open Dependabot PR (author dependabot[bot], same-repo head), merge only patch/minor in gomod/pip/npm; never github-actions, major, go-directive, grouped-with-major, unknown, digest-without-timestamp, or anything touching release.yaml, the merger, or workflows with id-token/contents/pages: write. Require every check run on the head SHA finished and green AND latest push verify on main green. Merge with gh pr merge --rebase --match-head-commit <sha>; never --auto/--squash/--merge. Else label needs-human.

Spec: openspec/specs/p5-dep-dependency-automation/spec.md — DEP-S02, REQs REQ-DEP-S02-01, REQ-DEP-S02-02, REQ-DEP-S02-05, REQ-DEP-S02-03, REQ-DEP-S02-04; proposed in #166. Gate-wiring rule: openspec/specs/README.md (every new guard, every mode, runs on pull_request in verify).

Acceptance (one PR; TDD — failing test first):

• REQ-DEP-S02-01 — classifier + gate script table-tested (patch, minor, major, digest, unknown, grouped, actions, workflow-touching, fork, human PR, release.yaml, pending/red check, red main) — bash hack/ci/dependabot_merge_test.sh
• REQ-DEP-S02-02 (adversarial) — every refusal fixture yields no merge call — bash hack/ci/dependabot_merge_test.sh --self-test
• REQ-DEP-S02-05 (adversarial) — head SHA changes between check and merge -> merge fails closed; always --match-head-commit — bash hack/ci/dependabot_merge_test.sh --self-test
• REQ-DEP-S02-03 (forbidden outcome) — only schedule/workflow_dispatch; --rebase --match-head-commit; no --auto/--squash/--merge/pull_request_target/workflow_run; no checkout — bash hack/lint/workflow_pins_test.sh
• REQ-DEP-S02-04 (post-merge) — first live run rebase-merges one patch bump (push verify follows) and leaves one major needs-human — gh pr list -R PlatformRelay/assent --label needs-human

Done when: every REQ's Verify passes on the PR (or is post-merge with its follow-up issue linked), task check is green, and the gate-wiring rule holds.

Source: spec/oss-quality-signals @ 94be853 (independent review + cold adversarial review, 2026-10-05).