chore: standard org automation (Dependabot + AI upgrade pipeline)

.github/dependabot.yml

@@ -0,0 +1,16 @@
+# managed-by: talieisin-org-bootstrap v2
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    groups:
+      minor-and-patch:
+        applies-to: version-updates
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
+      security:
+        applies-to: security-updates
+        patterns: ["*"]

.github/workflows/auto-merge.yml

@@ -0,0 +1,13 @@
+# managed-by: talieisin-org-bootstrap v1
+name: Auto-merge
+on: pull_request
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  auto-merge:
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
+    uses: Talieisin/.github/.github/workflows/auto-merge.yml@main
+    secrets: inherit

.github/workflows/dependabot-agent.yml

@@ -0,0 +1,29 @@
+# managed-by: talieisin-org-bootstrap v2
+# Fires when the org dispatcher labels a major Dependabot PR `ai-upgrade`.
+# All logic lives in Talieisin/.github — see its docs/ai-automation.md.
+name: AI upgrade
+on:
+  pull_request:
+    types: [labeled]
+
+permissions:
+  contents: read
+  pull-requests: write
+  checks: read
+  issues: write
+  actions: read
+
+jobs:
+  upgrade:
+    if: github.event.label.name == 'ai-upgrade'
+    uses: Talieisin/.github/.github/workflows/dependabot-upgrade.yml@main
+    with:
+      setup: none
+    secrets:
+      CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+      COPILOT_REVIEW_PAT: ${{ secrets.COPILOT_REVIEW_PAT }}
+      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+      TALIEISIN_AUTOMATION_APP_ID: ${{ secrets.TALIEISIN_AUTOMATION_APP_ID }}
+      TALIEISIN_AUTOMATION_APP_PRIVATE_KEY: ${{ secrets.TALIEISIN_AUTOMATION_APP_PRIVATE_KEY }}
+      TALIEISIN_TRIGGER_APP_ID: ${{ secrets.TALIEISIN_TRIGGER_APP_ID }}
+      TALIEISIN_TRIGGER_APP_PRIVATE_KEY: ${{ secrets.TALIEISIN_TRIGGER_APP_PRIVATE_KEY }}