Fix the two reasons auto-merge has never merged anything

[DenisDrobyshev]

What this changes

Two defects in the auto-merge workflow, both found by running it rather than by
reading it. Nothing it was supposed to do has ever worked.

1. It could not merge anything at all

Every Dependabot pull request opened since the workflow landed is red on the
same line:

failed to create review: GraphQL: GitHub Actions is not permitted to approve
pull requests. (addPullRequestReview)

This organisation does not allow Actions to approve pull requests. The step ran
gh pr review --approve before gh pr merge --auto, and under bash -e the
failed approval took the whole step down — so the merge was never queued. Five
red pull requests across five repositories, all this.

The approval was never needed. Branch protection here requires the CI check
and no reviews. It is removed rather than retried or made non-fatal, because a
step that "succeeds" after failing its first command is the kind of thing nobody
reads again.

2. It never auto-merged a grouped update

Its one clean run, on lemma#2 —
seven dependencies in one grouped pull request:

outputs.dependency-names: ipykernel, jupyter, matplotlib, mkdocs-material,
                          mkdocs-static-i18n, nbconvert, nbformat
outputs.update-type: null
outputs.dependency-group: docs-and-notebooks

update-type is empty for a group, because a group has no single update type.
The condition read only that field, so every grouped bump fell through to "needs
a human" — even one where all seven were patches. That is the group most worth
merging unattended, and grouping is why dependabot.yml groups at all.

updated-dependencies-json carries one entry per dependency with its own
updateType. The decision now requires every entry to be a patch, and moves
into its own step with a reason string so the run log says why.

Verified

The decision logic was extracted and run against nine cases:

case	verdict
actions group (no update-type)	merge — an actions bump
single patch	merge
single minor / single major	refuse
group, all patch	merge — a group of 2, every one a patch
group, one minor among patches	refuse — 1 beyond patch
group, all minor (the real lemma case)	refuse
update-type literally the string null	falls through to the group check
no metadata at all	refuse

Not yet verified: the exact shape of updated-dependencies-json from a real
grouped pull request. The field is documented and its entries carry
updateType, but the first genuine test is the next Dependabot run. If it is
wrong, the failure mode is refusing to merge — today's behaviour, not a bad
merge.

What breaks if this is wrong

Every branch that does not positively establish "patch" ends at auto=false, so
a misread refuses rather than merges. jq is preinstalled on ubuntu-latest.

Separately worth knowing: dependabot/fetch-metadata@v2 now warns that Node 20
is deprecated, and Dependabot has opened a v3 bump. That is a major version of
the action this logic reads its inputs from, so it is deliberately left to be
reviewed on its own rather than folded in here.

The file is generated from one template across all six repositories that carry
it, so they cannot drift the way this version did.