ci: restrict Dependabot auto-merge to classified minor and patch updates

[dinakarjs]

What this changes

Supplement to #513, based directly on its current head 15d031d7ff09879e9c5e8113bc70dbd41e9d9262. The existing proposal queues every Dependabot PR, including majors, and does not rerun when Dependabot pushes an update. Add synchronize, SHA-pinned verified Dependabot metadata, a nonempty-group gate requiring every update to be classified semver minor or patch, and event-head matching on gh pr merge. Major, unknown and malformed metadata stays manual.

Correct both pip comments to reflect the existing Python-major ignore policy. No dependency, normative specification, schema, approval or branch-protection policy changes. Ports the bounded safeguards from weight-custody-manifest#196, integrations#324, agent-manifest#505, cmcp#758 and ca2a#253.

Type of change

CI safeguard and regression tests; no normative effect.

Spec section

None.

Tests for a fix

Fifteen controls execute the actual workflow Bash block with real jq and a stubbed gh command. Accepted minor/patch groups queue once with the event head; major, mixed-major, unknown, missing, empty, non-object and malformed metadata does not queue. Tests use only pytest and the standard library, preserving TRACE's existing development dependencies; workflow YAML syntax is checked separately by actionlint.

In an isolated temporary copy, bypassing the metadata gate made the refusal assertions fail for major, unknown, empty, mixed, non-object and malformed inputs, while the valid patch control passed. No mutation was committed.

Independent local Python 3.12.14 validation using the hash-locked SDK environment and explicit checkout imports: full reference-library suite 3,967 passed / 48 skipped; focused controls 15 passed; ruff check src tests scripts, mypy (15 source files), house-style and whitespace checks passed. Separate conformance suite was not rerun for this CI-only change. Shell controls run on Linux, matching the Ubuntu auto-merge runner.

No separate fresh-reader review has been obtained for this supplement. Normal maintainer review and CI on the combined #513 revision remain required. The first genuine Dependabot run still needs validation of the bot-specific path after integration; this human-authored PR does not exercise it.

Checklist

• DCO sign-off on the commit.
• No normative or breaking change; changelog and normative-change markers do not apply.

Signed-off-by: Srinivasa Dinakar Jainti dinakarjs@gmail.com

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AgenTrust Contributor Check.