Fix dependabot auto-merge workflow: branch protection + Node 20 deprecation

[Copilot]

gh pr merge --rebase was failing immediately when branch protection rules required status checks to pass. Additionally, dependabot/fetch-metadata@v2.3.0 was triggering Node.js 20 deprecation warnings on current runners.

Changes

• dependabot/fetch-metadata v2.3.0 → v3.1.0 — natively targets Node.js 24, eliminating the deprecation warning
• --auto flag on gh pr merge — queues the merge until branch protection requirements are satisfied instead of failing outright
• || true — prevents workflow failure when auto-merge is not enabled at the repository level

[DavidIQ]

@copilot Are you sure about this? Will this merge the pr if the first command fails?

[Copilot]

Good question. The || true does not merge the PR if the --auto command fails — it only prevents the workflow from reporting a failure exit code.

The design here is:

• --auto is needed because branch protection rules block an immediate merge; --auto queues the merge to happen once all checks pass
• If the repository doesn't have auto-merge enabled at the settings level, gh pr merge --auto will fail with an error — || true makes that a silent no-op rather than a red workflow run

If the first command fails (e.g. auto-merge not enabled), the PR simply won't be merged automatically, but the workflow won't show as broken. If you'd rather have the workflow fail loudly in that case, I can remove the || true.

[DavidIQ]

@copilot what about trying a direct merge as well as the auto merge?

[Copilot]

Done in bf25cbe. The command is now gh pr merge --auto --rebase "$PR_URL" || gh pr merge --rebase "$PR_URL" — it tries auto-merge first, and falls back to a direct merge if auto-merge isn't available.