ci(github): use app token for dependabot merges

[ncipollina]

Summary

Updates the Dependabot auto-merge workflow to use the LayeredCraft GitHub App token for approving and enabling auto-merge. This avoids using GITHUB_TOKEN for the merge operation so downstream workflows can run after Dependabot auto-merged changes land on main.

Changes

• Adds a SHA-pinned actions/create-github-app-token step for semver patch/minor Dependabot PRs.
• Uses the generated app token as GH_TOKEN for gh pr review --approve and gh pr merge --auto --squash.
• Keeps dependabot/fetch-metadata on the default GITHUB_TOKEN.

Validation

• Reviewed workflow syntax and token usage.
• No build required; workflow-only change.

Notes for Reviewers

Requires the Actions secrets DEPENDABOT_AUTOMERGE_APP_ID and DEPENDABOT_AUTOMERGE_PRIVATE_KEY to be available to this repository.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ab4d3e7982

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Avoid unavailable secrets in Dependabot target

For the opened/synchronize events this workflow is meant to automate, Dependabot is the actor, and this pull_request_target job is gated to Dependabot-authored PRs; GitHub documents that in this case the workflow receives a read-only token and “secrets are not available” (https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-on-actions#restrictions-when-dependabot-triggers-events). These inputs therefore resolve empty on normal Dependabot PRs, causing token generation to fail before approval/auto-merge; the app-token step needs to run from a trusted non-Dependabot-triggered workflow (for example a workflow_run) or another trigger where the app credentials are available.

Useful? React with 👍 / 👎.