ci: bypass L1/Issue/NOW gates for trusted bots

Closes #1059

Dependabot PRs (#1057 rusqlite, #1058 chrono) fail three gates by design:
- L1 TRACEABILITY (commits need Closes #N)
- Issue Gate (PR body needs Closes|Fixes|Resolves #N)
- NOW Sync Gate (docs/NOW.md must change)

Bots maintain deps -- not features -- and cannot reference issues.

Adds job-level guard:
  if: github.actor != 'dependabot[bot]' && github.actor != 'github-actions[bot]'

Effect: gates are SKIPPED (not FAILED) for trusted bot actors.
Constitutional Law L1 still enforced for all human PRs.

The L1 summary job now reports 'Skipped (trusted bot actor)' for clarity.

Author: gHashTag

.github/workflows/issue-gate.yml

@@ -12,6 +12,8 @@ permissions:
 jobs:
   check-linked-issue:
     runs-on: ubuntu-latest
+    # Closes #1059: bypass Issue Gate for trusted bots (Dependabot opens dep PRs without issues)
+    if: github.actor != 'dependabot[bot]' && github.actor != 'github-actions[bot]'
     steps:
       - name: Check for linked issues in PR
         env:

.github/workflows/l1-traceability.yml

@@ -8,6 +8,8 @@ jobs:
   check-traceability:
     name: Check L1 TRACEABILITY
     runs-on: ubuntu-latest
+    # Closes #1059: bypass L1 gate for trusted bots (Dependabot maintains deps, not features)
+    if: github.actor != 'dependabot[bot]' && github.actor != 'github-actions[bot]'
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -138,6 +140,8 @@ jobs:
           echo "### L1 TRACEABILITY Check Results" >> $GITHUB_STEP_SUMMARY
           if [ "${{ needs.check-traceability.result }}" = "success" ]; then
             echo "✅ All commits comply with L1 TRACEABILITY" >> $GITHUB_STEP_SUMMARY
+          elif [ "${{ needs.check-traceability.result }}" = "skipped" ]; then
+            echo "⏭️ L1 TRACEABILITY check skipped (trusted bot actor)" >> $GITHUB_STEP_SUMMARY
           else
             echo "❌ L1 TRACEABILITY violations detected" >> $GITHUB_STEP_SUMMARY
             echo "" >> $GITHUB_STEP_SUMMARY

.github/workflows/now-sync-gate.yml

@@ -8,6 +8,8 @@ on:
 jobs:
   check-now-freshness:
     runs-on: ubuntu-latest
+    # Closes #1059: bypass NOW Sync Gate for trusted bots (deps PRs don't touch docs/NOW.md)
+    if: github.actor != 'dependabot[bot]' && github.actor != 'github-actions[bot]'
     steps:
       - uses: actions/checkout@v4
         with: