fix(ci): guard Dependabot auto-approval

[netopsengineer]

Summary

• Approve only the current revision of a Dependabot-authored PR when the event sender is Dependabot or the existing trusted optimizer release bot.
• Keep the repository ruleset at one required approval for human-authored PRs.
• Require same-repository heads and immutable GitHub account IDs.
• Correct CODEOWNERS, Dependabot, and contributor documentation to match the live ruleset and its three required checks.

Root cause

Dependabot auto-merge was enabled successfully, but the main-branch ruleset still required one approving review. The workflow waited indefinitely because it enabled auto-merge without submitting a guarded approval.

Security boundary

A human push dismisses the prior revision's approval and fails the trusted-sender guard, so it cannot inherit or refresh the automated approval. The job does not check out or execute pull-request code.

Validation

• uv sync --locked
• uv run pytest (525 passed, 100% line and branch coverage)
• uv run pyright
• uv run ruff check .
• uv run pydoclint src/skill_optimizer optimize_description_v2.py
• uvx bandit -c pyproject.toml -r src optimize_description_v2.py
• sourcery review src/skill_optimizer optimize_description_v2.py tests (26 files, no issues)
• uv run prek run --all-files, including gitleaks, actionlint, and zizmor
• Markdown formatting, lint, diff, and Unicode validation