Enable Dependabot auto-merge for minor and patch updates

[Copilot]

Automatically merge Dependabot PRs for semver-minor and semver-patch updates when CI passes. Major version updates still require manual review.

Implementation

Workflow: .github/workflows/dependabot-auto-merge.yml

• Triggers on PR events from dependabot[bot]
• Fetches metadata via dependabot/fetch-metadata@v2 to determine update type
• Waits for build-and-test job completion using lewagon/wait-on-check-action@v1.3.4
• Auto-merges using squash strategy if update type is version-update:semver-minor or version-update:semver-patch
• Requires contents: write and pull-requests: write permissions

Documentation: CONTRIBUTING.md

• Added "Dependency Management" section documenting auto-merge behavior
• Clarified which update types are auto-merged vs. require manual review

Behavior

Update Type	CI Pass	Action
Patch/Minor	✅	Auto-merge
Patch/Minor	❌	Block merge
Major	✅/❌	Manual review required

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.