fix(ci): skip commit message check for dependabot push events

[otavio]

Summary

• The commit message check workflow fails on push events to master when dependabot commits are merged
• The if condition used github.event.pull_request.user.login to detect dependabot, which is null on push events, so the check always ran
• Replace with github.actor which is set for both push and PR events

Test plan

• Verify the workflow still runs for normal commits on this PR
• After merge, confirm the next dependabot push to master no longer triggers the check

[github-actions]

Claude finished @otavio's task in 4m 18s —— View job

---

Code Review Complete

Reviewed 1 file across code quality, security, testing, language patterns, and architecture — no issues found. The code looks good as-is.

The condition logic was verified against all trigger scenarios:

Scenario	Result	Correct?
push + dependabot[bot] actor	Skipped	Yes
push + human actor	Runs	Yes
pull_request + dependabot[bot] actor	Skipped	Yes
pull_request + human + non-draft	Runs	Yes
pull_request + human + draft	Skipped	Yes

Additional notes

The architecture review found that .github/workflows/qa.yml (line 14) uses the same fragile github.event.pull_request.draft == false pattern without an explicit push-event fallback. It works today because null == false evaluates to true in GitHub Actions expressions, but for consistency with this fix, it could be updated to:

if: ${{ github.event.pull_request.draft == false || github.event_name == 'push' }}

This is outside the scope of this PR and not blocking.

Also confirmed that cloud/.github/workflows/commit.yml already has the identical condition, so both repos will be in sync after this merges.

---

To request another review round, comment /review.