ci: gate Dependabot auto-merge on github.actor, not PR author (#616)

Fixes "PR is not from Dependabot, nothing to do" from
dependabot/fetch-metadata. The job gated on the PR author (always
dependabot), so it ran even when a human triggered the event (e.g. clicked
"Update branch"); fetch-metadata then checks github.actor, sees the human,
and aborts with exit 1. Gating the whole job on
`github.actor == 'dependabot[bot]'` (GitHub's documented pattern) means
human-triggered events skip cleanly instead of failing.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: nolik

.github/workflows/dependabot-automerge.yml

@@ -17,8 +17,12 @@ permissions:
 jobs:
   auto-merge:
     runs-on: ubuntu-latest
-    # Only act on Dependabot's own PRs.
-    if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}
+    # Only act on events Dependabot itself triggered (opened the PR or rebased
+    # it). Gating on `github.actor` — not the PR author — matches what
+    # dependabot/fetch-metadata requires: when a human triggers the event (e.g.
+    # clicks "Update branch"), github.actor is that human and fetch-metadata
+    # aborts with "PR is not from Dependabot". Skipping the job avoids that.
+    if: ${{ github.actor == 'dependabot[bot]' }}
     steps:
       - name: Fetch Dependabot metadata
         id: metadata