fix(ci): Dependabot checks:read

[gitctrlx]

Depends on qntx/workflows#42 (callee checks: read + actions: read) and moving annotated v2.

workflow_call tokens are the intersection of caller and callee. Without these keys on the caller job, private statusCheckRollup 403s.

Private callers use 0 */6 * * * (Actions rounds each job to 1 billed minute). Public stays */15.

[Copilot]

Pull request overview

Updates the Dependabot merge-sweeper workflow to grant the additional GitHub token permissions required when calling the shared qntx/workflows reusable workflow, preventing 403s when fetching check/status rollups in private repos.

Changes:

• Add checks: read and actions: read to the workflow-level token permissions.
• Add the same permissions to the merge job that invokes the reusable workflow.
• Clarify workflow comments around scheduling and behavior.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.