ci: auto-merge Dependabot PRs

[Solvely-Colin]

What this does

Adds a GitHub Actions workflow that automatically handles Dependabot PRs:

• Auto-approves and auto-merges (squash) patch and minor dependency updates once CI passes
• Flags major version bumps with a comment and major-update label for manual review — no auto-merge

How it works

1. Triggers on any pull_request event from dependabot[bot]
2. Uses dependabot/fetch-metadata to detect the semver update type
3. For patch/minor: approves the PR and enables GitHub's auto-merge (squash)
4. For major: adds a warning comment and skips auto-merge

Requirements

• Auto-merge must be enabled in the repo settings (Settings → General → Allow auto-merge)
• Branch protection rules with required status checks will gate the merge

Safety

• Major version bumps are never auto-merged
• All updates still must pass CI before merging
• Uses only the default GITHUB_TOKEN — no PATs needed