Hold semver-major Dependabot bumps for a human

.github/dependabot.yml

@@ -37,3 +37,6 @@ updates:
       github-actions:
         patterns:
           - "*"
+        update-types:
+          - "minor"
+          - "patch"

.github/workflows/pages.yml

@@ -58,11 +58,13 @@ jobs:
     steps:
       - id: meta
         uses: dependabot/fetch-metadata@v3
-      # Majors included on purpose. `needs:` above already required the whole
-      # gate to pass, and that gate -- unit tests, build, axe WCAG and the e2e
-      # claims -- judges a bump far better than its version number does. A major
-      # that actually breaks this lab fails the gate and stays open for a human.
+      # Majors wait for a human. `needs:` above already required the whole gate
+      # to pass, and that gate judges whether a bump works far better than its
+      # version number does -- but a green gate is not consent to a breaking
+      # change, so a semver-major is left open for someone to look at. Minor and
+      # patch still merge themselves.
       - name: Merge any bump whose gate went green
+        if: steps.meta.outputs.update-type != 'version-update:semver-major'
         # Retry: a sibling PR merging first moves main underneath us and GitHub
         # rejects with "Base branch was modified". That is benign, so try again
         # rather than failing the run over a race.