ci: auto-merge eligible dependabot updates

[chenrui333]

Summary

• Add a workflow_run auto-merge path for successful Dependabot PRs.
• Skip draft PRs, semver-major updates, unexpected files, and stale heads before merging.
• Limit grouped Dependabot version updates to minor/patch updates and rename the GitHub Actions group.
• Bump the undici override to 6.27.0 and rebuild dist to clear the current npm audit advisory.

Notes

• This uses the existing main workflow as the merge gate because repository auto-merge is currently disabled.
• There are no open Dependabot PRs left after chore(deps): bump the npm group with 6 updates #153 merged.