ci: auto-merge green Dependabot PRs (minor/patch)

.github/allowed-actions.txt

@@ -18,3 +18,6 @@ gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e
 azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906
 azure/webapps-deploy@02a81bead70021f5284939794bcec79c271ab383
 Azure/static-web-apps-deploy@1a947af9992250f3bc2e68ad0754c0b0c11566c9
+
+# Reads Dependabot update metadata so dependabot-auto-merge.yml can hold major bumps.
+dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98

.github/workflows/dependabot-auto-merge.yml

@@ -0,0 +1,41 @@
+name: Dependabot auto-merge
+
+# Turns on GitHub's native auto-merge for Dependabot pull requests, so a PR whose
+# every required status check passes merges itself instead of waiting for a human.
+# Branch protection still fully gates the merge — nothing red lands, and required
+# checks/reviews are still enforced.
+#
+# Scope: minor and patch updates only. Major bumps are left open for a human to read
+# the changelog first. Uses only the automatic GITHUB_TOKEN — no PAT or extra secrets.
+# Requires "Allow auto-merge" in Settings > General (enabled for this repo).
+#
+# dependabot/fetch-metadata is SHA-pinned and listed in .github/allowed-actions.txt
+# plus the repository's selected-actions setting, as this repo's allowlist requires.
+
+on: pull_request
+
+# Read-only by default; the one job that needs it grants itself the minimum below.
+permissions:
+  contents: read
+
+jobs:
+  auto-merge:
+    if: github.actor == 'dependabot[bot]'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    # Scoped to the job, not the workflow: enabling auto-merge is a pull-request
+    # write, and the merge itself is performed later by GitHub, so nothing here
+    # needs contents: write (least privilege — GHA002/GHA003).
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Fetch Dependabot metadata
+        id: meta
+        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
+
+      - name: Enable auto-merge for non-major updates
+        if: steps.meta.outputs.update-type != 'version-update:semver-major'
+        run: gh pr merge --auto --squash "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}