👷 Support Dependabot in automerge workflow

[AnandChowdhary]

Summary

• fall back to the repository-scoped github.token when GH_PAT is unavailable to Dependabot
• declare the minimal workflow permissions needed by the merge and branch-cleanup actions
• keep GH_PAT as the preferred token for normal pull-request events

Why

Fresh Dependabot PRs #159–#161 all reported red Merge PRs checks because Dependabot workflows cannot access Actions secrets, leaving GITHUB_TOKEN empty before the automerge action could evaluate labels. The fallback lets read-only Dependabot events complete safely instead of failing while preserving the existing PAT path for write operations.

Test plan

• Reproduced the failure from Actions logs (environment variable GITHUB_TOKEN not set)
• Parsed all 12 workflow files as YAML
• actionlint passes for .github/workflows/automerge.yml
• Node 14.21.3 / npm 6.14.18: npm ci, npm run build, and npm test -- --runInBand
• git diff --check and added-line security scan