fix(dependabot-merge): merge Dependabot PRs once a person approves

[arzafran]

What & why

Dependabot auto-merge stopped merging anything once the org added the Review required ruleset on Oct 1. The merge step fails with "the base branch policy prohibits the merge" because nobody approved the PR. All seven repos that call this workflow have review: Required, so they all hit it. Example: charge-cars-website run for PR #2.

With this change, an eligible Dependabot PR merges as soon as two things are true of the same commit: its CI passed, and a person approved it. Whichever happens last triggers the merge. The workflow never approves anything itself.

How it works:

1. Callers also trigger the workflow on pull_request_review: submitted. The job runs for approvals of Dependabot PRs from the same repo.
2. Each run re-checks the current head from scratch: the existing title/version, release-age and latest-CI checks, plus a human (user.type == "User") approval whose commit_id is that head. An approval of an older head does not count, so if Dependabot pushes a different version, that version needs its own approval.
3. On an approval-triggered run, the CI check looks up the workflow named by the new ci-workflow input (default CI) and requires its latest run on the head to have passed. ci-gate is refused here too.
4. Nothing is left armed between runs. An earlier draft of this PR used gh pr merge --auto, but armed auto-merge outlives the commit the workflow checked and merges on required checks alone, which skipped the version and release-age guards after a Dependabot push. This session saw Dependabot change a PR from 11.6.0 to 11.6.1 during a rebase, so that case is real.

Per-head concurrency keeps the CI run and the approval run from racing. The loser finds the PR closed and exits.

Callers need the extra trigger (README shows it). Without it, nothing changes from today: CI-triggered runs still wait for an approval that never triggers a merge.

How to verify

1. actionlint .github/workflows/dependabot-merge.yml shows only the SC2129 style note that is already on main.
2. The jq filters were checked against fixtures: a superseded CI run, a stale approval, a bot approval and a head with no CI run each block the merge, and a human approval on a green head merges.
3. Live check after merge: bump charge-cars-website's pin and add the trigger, then approve the next eligible Dependabot PR. Expect the approval run to merge it, and a run started by CI before approval to log "waiting for an approval".

Checklist

• PR is focused on a single logical change
• Linked the related issue (or explained why there isn't one): no issue, found while merging charge-cars-website Dependabot PRs
• Lint/format/tests pass locally
• Updated docs/types where relevant