chore(ci): address copilot feedback on dependabot/android workflow

- test-android.yml: install Android SDK 36 / build-tools 36.0.0 to match
  the RN samples' compileSdkVersion = 36 (was 35, would fail clean runner)
- dependabot.yml: clarify that RN auto-merge exclusion is directory-based
  in the auto-merge workflow, not label-based

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ksroda-sa

.github/dependabot.yml

@@ -90,9 +90,11 @@ updates:
     commit-message:
       prefix: "deps"
 
-  # React Native samples — labelled "manual-review" so the auto-merge workflow
-  # skips them. Dep bumps here can break native autolinking / API shapes that
-  # `tsc --noEmit` doesn't catch; require human eyes on every update.
+  # React Native samples — the auto-merge workflow excludes
+  # /samples/react-native/* by directory match, so bumps here always require
+  # human review. Dep bumps can break native autolinking / API shapes that
+  # `tsc --noEmit` doesn't catch. The "manual-review" label is informational
+  # only (the workflow filter is directory-based, not label-based).
   - package-ecosystem: "npm"
     directory: "/samples/react-native/login-pkce"
     schedule:

.github/workflows/test-android.yml

@@ -53,7 +53,7 @@ jobs:
       - name: Set up Android SDK
         uses: android-actions/setup-android@v3
         with:
-          packages: "platform-tools platforms;android-35 build-tools;35.0.0"
+          packages: "platform-tools platforms;android-36 build-tools;36.0.0"
 
       # React Native samples need their JS deps installed first so autolinking
       # can resolve native modules from node_modules. Detect by walking up to