fix(auto-merge): require same-repo head before enabling auto-merge

[ANcpLua]

Syncs auto-merge.yml to the canonical template from github-settings-automation.

enable-auto-merge ran under pull_request_target and gated only on the head branch prefix (claude/, codex/, copilot/). A branch prefix is chosen by whoever opens the PR, and pull_request_target grants fork PRs the base repo's write token — so any fork could push a matching branch and land it on main unreviewed. The "require a pull request" ruleset does not mitigate this, since native auto-merge lands the change through a PR.

This repo is consumed fleet-wide as a shared Renovate preset, so an unreviewed merge here propagates.

🤖 Generated with Claude Code

[github-actions]

@coderabbitai autofix

[coderabbitai]

This command requires write access to the repository. Only users with write or admin permissions can trigger CodeRabbit to commit or create pull requests.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: e98395a1-bb74-4a1d-8714-8ea3bdf4da72

📥 Commits

Reviewing files that changed from the base of the PR and between 5f24520 and f97c651.

📒 Files selected for processing (1)

• .github/workflows/auto-merge.yml

Cache: Disabled due to data retention organization setting

Knowledge base: Disabled due to data retention organization setting

---

📝 Walkthrough

Walkthrough

This PR modifies the auto-merge GitHub Actions workflow. Trigger events are restricted: pull_request_target now excludes the closed action, limited to opened, synchronize, reopened, and ready_for_review, and a new pull_request_review submitted trigger is added. The enable-auto-merge job condition is narrowed from a multi-prefix/approval-based policy to require a non-draft, same-repo PR with a head branch starting with claude/. A delete-merged-branch job is added/expanded to delete merged claude/ branch refs via the GitHub CLI on closed-and-merged same-repo PRs, tolerating already-deleted branches.

---

_{Comment @coderabbitai help to get the list of available commands.}