Refresh GPD skills and agent definitions (#8)

* Refresh GPD skills and agent definitions

Author: MichaelsEngineering

.github/CODEOWNERS

@@ -1,5 +1,3 @@
-*                 @MichaelsEngineering
-.github/**       @MichaelsEngineering
 plans/**         @MichaelsEngineering
 scripts/agent-orchestrator/** @MichaelsEngineering
 src/**           @MichaelsEngineering

.github/dependabot.yml

@@ -8,13 +8,6 @@ updates:
       time: "03:00"
       timezone: "UTC"
     open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
-      - "security"
-    assignees:
-      - "MichaelsEngineering"
-    reviewers:
-      - "MichaelsEngineering"
     groups:
       python-security:
         applies-to: security-updates
@@ -33,13 +26,6 @@ updates:
       time: "03:15"
       timezone: "UTC"
     open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
-      - "security"
-    assignees:
-      - "MichaelsEngineering"
-    reviewers:
-      - "MichaelsEngineering"
     groups:
       actions-security:
         applies-to: security-updates

.github/workflows/dependabot-auto-merge.yml

@@ -0,0 +1,45 @@
+name: dependabot-auto-merge
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - ready_for_review
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  dependabot:
+    name: dependabot
+    if: github.event.pull_request.user.login == 'dependabot[bot]' && !github.event.pull_request.draft
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fetch Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@d7267f607e9d3fb96fc2fbe83e0af444713e90b7
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Approve safe Dependabot updates
+        if: |
+          startsWith(steps.metadata.outputs.update-type, 'security-update:') ||
+          steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
+          steps.metadata.outputs.update-type == 'version-update:semver-minor'
+        run: gh pr review --approve "$PR_URL"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+
+      - name: Enable auto-merge for safe Dependabot updates
+        if: |
+          startsWith(steps.metadata.outputs.update-type, 'security-update:') ||
+          steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
+          steps.metadata.outputs.update-type == 'version-update:semver-minor'
+        run: gh pr merge --auto --squash "$PR_URL"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_URL: ${{ github.event.pull_request.html_url }}

.github/workflows/dependency-review.yml

@@ -0,0 +1,32 @@
+name: dependency-review
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  dependency-review:
+    name: dependency-review
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
+        with:
+          fetch-depth: 0
+      - name: Detect dependency file changes
+        id: changed
+        run: |
+          if git diff --name-only "${{ github.event.pull_request.base.sha }}" "${{ github.event.pull_request.head.sha }}" | grep -Eq '^(pyproject\.toml|uv\.lock)$'; then
+            echo "run_review=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "run_review=false" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Skip dependency review when no package manifests changed
+        if: steps.changed.outputs.run_review != 'true'
+        run: echo "No dependency manifest changes detected; skipping dependency review."
+      - name: Review dependency changes
+        if: steps.changed.outputs.run_review == 'true'
+        uses: actions/dependency-review-action@v4