ci: verify every Dependabot PR commit

[jarvisimus]

Summary

• distinguish package publisher changes from human-added PR commits
• verify every Dependabot PR commit through the GitHub API before enabling native auto-merge
• require Dependabot authorship, GitHub web-flow committer identity, and a valid verified signature
• fail closed and revoke auto-merge when metadata or commit trust fails
• bind revocation to the expected head SHA and cancel stale per-PR workflow runs

Security properties

• pull_request_target never checks out or executes PR code
• metadata and commit inspection remain read-only
• write permissions exist only in the enable/revoke jobs
• package publisher changes continue to require manual review
• major dependency updates continue to require manual review

Verification

• actionlint v1.7.12
• YAML parse
• staged diff check
• exact trust predicate exercised against all current Dependabot PRs
• independent Codex review: no actionable regressions