Fix dependency auto-merge workflow env contract test

[MarvinSchenkel]

What does this implement/fix?

#5499 added a refresh-stale job that mints a GitHub App token, so
auto-merge-dependency-updates.yml gained EXPECTED_APP_SLUG and
EXPECTED_APP_INSTALLATION_ID in its top-level env.
test_dependency_auto_merge_enforces_app_bot_identity_contract asserts that
env mapping exactly and still listed only the three bot-login constants, so
dev is red.

That assert is the first one in the test, so every later assertion in the
function was skipped in CI as well.

Changes

• Add both constants to the expected env mapping.
• Assert that the Verify GitHub App identity step of refresh-stale compares
  against both, so the new constants stay covered instead of only declared.

Related issue (if applicable):

• related issue

Types of changes

• Bugfix (non-breaking change which fixes an issue) — bugfix
• New feature (non-breaking change which adds functionality) — new-feature
• Enhancement to an existing feature — enhancement
• New music/player/metadata/plugin provider — new-provider
• Breaking change (fix or feature that would cause existing functionality to not work as expected) — breaking-change
• Refactor (no behaviour change) — refactor
• Documentation only — documentation
• Maintenance / chore — maintenance
• CI / workflow change — ci
• Dependencies bump — dependencies

Checklist

• The code change is tested and works locally.
• pre-commit run --all-files passes.
• pytest passes, and tests have been added/updated under tests/ where applicable.
• For changes to shared models, the companion PR in music-assistant/models is linked.
• For changes affecting the UI, the companion PR in music-assistant/frontend is linked.
• I have read and complied with the project's AI Policy for any AI-assisted contributions.
• I have raised a PR against the documentation repository targeting the main or beta branch as appropriate.

[Copilot]

Pull request overview

Updates the dependency auto-merge workflow contract test to reflect the expanded workflow env (added for the refresh-stale GitHub App token job) and to ensure the new identity fields remain enforced.

Changes:

• Extend the expected top-level env mapping in test_dependency_auto_merge_enforces_app_bot_identity_contract to include EXPECTED_APP_SLUG and EXPECTED_APP_INSTALLATION_ID.
• Add assertions that the refresh-stale job’s Verify GitHub App identity step checks both the app slug and installation id.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.