fix(ci): merge Dependabot PRs directly instead of via --auto

[dantech2000]

Follow-up to #99. That fixed attribution; this fixes the merge actually succeeding.

The error

GraphQL: Auto merge is not allowed for this repository (enablePullRequestAutoMerge)

$ gh api repos/dantech2000/refresh --jq '{allow_auto_merge}'
{"allow_auto_merge": false}

GitHub's auto-merge feature is disabled on this repo, so gh pr merge --auto only ever worked by accident — when a PR happened to be fully green and mergeable at that instant, gh merged it directly; otherwise the call errored. That's precisely the observed mix of success and failure runs, and why #82–#95 piled up with autoMerge=no.

Why not just enable the repo setting

Because there's no branch protection, so there are no required status checks. Repo-wide auto-merge would merge any PR the moment it became mergeable, whether or not CI had run — a footgun well beyond Dependabot.

We don't need it. The two wait-for-check gates already block until Run go test and Run golangci-lint report success, and the merge step's if requires both conclusions to be success. By the time execution reaches the merge, checks have demonstrably passed. A direct merge is equivalent in safety, and it fails loudly on conflict instead of queueing silently forever.

Evidence the combined fix works

commit	how merged	workflows triggered
ab21bd1 (#99)	manually, as a user	Test, Lint, Release Please ✅
37f1d0f (#100)	auto-merged, old token	none ❌

#99's GH_PAT gives correct attribution; this PR makes the merge call succeed in the first place. Together the full path works: bump merged as a real user → Test/Lint/Release Please fire on main → fix(deps) cuts a patch release.

Verification

command: gh pr merge ${{ ... }} --squash --delete-branch
has --auto flag: False
token: ${{ secrets.GH_PAT }}

The real proof is the next Dependabot PR: it should merge cleanly, and the resulting main commit should show Test, Lint, and Release Please runs.