Fix auto-merge: use pull_request_target, least-privilege permissions

- Switch trigger to pull_request_target so GITHUB_TOKEN runs in base-branch
  context with full permissions (pull_request gives read-only token for
  Dependabot workflows since GitHub's 2021 security change)
- Drop workflows:write (not needed; merge only requires contents+pull-requests)
- Move permissions to job level (least privilege)
- Use github.event.pull_request.user.login instead of github.actor

Author: woutervh

.github/workflows/dependabot-auto-merge.yaml

@@ -11,10 +11,7 @@ name: Auto Merge Dependabot
 on:
   pull_request_target:
 
-permissions:
-  contents: write
-  pull-requests: write
-  workflows: write
+permissions: {}
 
 jobs:
   auto-merge:
@@ -23,8 +20,12 @@ jobs:
 
     timeout-minutes: 5
 
+    permissions:
+      contents: write
+      pull-requests: write
+
     # Only run for Dependabot PRs - security: prevent running on PRs from forks or other actors
-    if: github.actor == 'dependabot[bot]'
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
 
     steps: