feat(workflow-templates): add dependabot-auto-merge caller stub + properties

[twistedmelonman]

Summary

Mirrors smartwatermelon/.github#11. Part of Part A2/A4 of the reusable-workflows plan. Replaces this template's self-contained dependabot-auto-merge.yml body with a caller stub pointing at the new reusable workflow being added in smartwatermelon/github-workflows#96. Adds the missing dependabot-auto-merge.properties.json so the workflow-templates picker actually offers this template (Part B's B1 deliverable per the plan — confirmed silently absent from the picker during Q2 planning validation).

Actor guard — confirmed preserved

The reusable workflow (smartwatermelon/github-workflows commit ad3f0ec, PR #96) keeps the same if: github.actor == 'dependabot[bot]' guard, now at the reusable's auto-merge job level instead of this caller's — it was moved, not dropped.

Blocking on tag creation

Temporarily pinned to the github-workflows commit SHA ad3f0ec080ad5b119f2359bf42de6623c4730544 (the tip of PR #96's branch at the time this PR was opened) rather than a tag, since dependabot-auto-merge-v1 doesn't exist until that PR merges and the tag is cut (~1 minute after merge, per that fleet's convention). Caveat: this SHA is real and fetchable today (it's a pushed branch tip), but if PR #96 is squash-merged, the final commit on github-workflows main will have a different SHA than this one. Follow-up PR needed here regardless — either to repoint to @dependabot-auto-merge-v1 once cut, or sooner if this exact SHA stops resolving.

Test plan

• YAML valid, yamllint clean (one pre-existing-style line-length warning)
• JSON valid
• Local code-reviewer + adversarial-reviewer: PASS
• Pre-push full-diff + whole-codebase review: PASS (flagged a pre-existing, out-of-scope observation that dependabot.yml's github-actions ecosystem entry doesn't scan workflow-templates/, so pins there won't get automated bump PRs — noting for the record, not fixing here)
• Manual: once merged, confirm the workflow-templates picker offers "Dependabot Auto-Merge" on a fresh nightowlstudiollc repo (Q2 in the plan)
• Follow-up: repoint SHA pin to @dependabot-auto-merge-v1 once that tag is cut in github-workflows

Claude-Session: https://claude.ai/code/session_0143Nf4sXqnTp2Kx3LNbMvBA

[claude]

No blocking issues found. The PR converts an inline dependabot-auto-merge job into a caller stub for a reusable workflow, and adds the required .properties.json picker metadata.

The floating-tag pin (@dependabot-auto-merge-v1) under pull_request_target with contents: write / pull-requests: write is a real supply-chain tradeoff, but it is explicitly documented and acknowledged in the file header as a deliberate decision mirroring the existing claude-blocking-review.yml@v3 pattern.

VERDICT: PASS