fix(ci): Dependabot checks:read

[gitctrlx]

Depends on qntx/workflows#42 (callee checks: read + actions: read) and moving annotated v2.

workflow_call tokens are the intersection of caller and callee. Without these keys on the caller job, private statusCheckRollup 403s.

Private callers use 0 */6 * * * (Actions rounds each job to 1 billed minute). Public stays */15.

[Copilot]

Pull request overview

Updates the Dependabot auto-merge caller workflow to grant the additional GITHUB_TOKEN permissions required by the reusable ops-dependabot workflow (notably to avoid private statusCheckRollup 403s when invoked from private repos).

Changes:

• Add checks: read and actions: read permissions at both workflow and job scope for the reusable-workflow call.
• Refine header comments to clarify behavior and public vs. private cron guidance.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.