fix(auto-merge): restrict privileged merge workflow to trusted bots

[devantler]

Problem

The shared .github/workflows/enable-auto-merge.yaml currently runs for every non-draft pull request and executes gh pr merge --auto --squash with the GitHub App token. That includes human-authored devantler PRs, even though the portfolio merge contract reserves auto-merge for trusted single-author bots and requires human-authored promoted PRs to be merged directly only after the current-head pentad is green.

Live proof: KSail #6042 was human-authored, had CodeRabbit pre-merge not-posted and no fresh current-head green review, yet organization required-workflow run 29162215382 armed auto-merge at 17:46Z and app/ksail-bot merged it at 18:09Z.

The organization ruleset still sources the identical frozen workflow from archived devantler-tech/reusable-workflows; .github#87 tracks repointing that ruleset to actions. Repointing alone will preserve this bypass because the current actions@main copy is identical.

Proposed direction

Make the auto-merge job fail closed to an explicit trusted-bot author allowlist using the pull-request event payload. Human-authored and unknown-author PRs should skip the privileged approval/auto-merge job while leaving the required workflow successful/skipped. Keep direct event values in the expression; do not interpolate untrusted PR text into shell.

Initial allowlist from the canonical merge policy:

• dependabot[bot]
• renovate[bot]
• github-actions[bot]
• ksail-bot[bot]
• coderabbitai[bot]

Then update .github#87's rollout order: land this workflow fix in actions, repoint the required-workflow ruleset, and verify one human PR is not auto-armed while one trusted-bot PR is.

Acceptance criteria

• A regression test proves a human-authored non-draft PR does not run the privileged job.
• Each explicitly trusted bot remains eligible.
• Unknown/external authors are denied by default.
• Draft and non-pull_request behavior remains safe.
• The workflow remains valid and pinned-action checks stay green.
• .github#87 records the dependent repoint-and-verify rollout.

Rough size

S-M: one shared workflow conditional plus table-driven fixture tests and coordinated org-ruleset rollout verification.

Related: devantler-tech/.github#87, devantler-tech/monorepo#2128.

[coderabbitai]

🔗 Related PRs

#402 - fix(enable-auto-merge-on-pr): retry-harden the gh API/merge network calls [merged]
#405 - fix(approve-pr,upsert-issue): retry-harden unguarded gh network calls [merged]
#412 - ci: skip the suite on the release-commit push to dodge the self-pin tag race [merged]
#427 - fix: resolve first-party self-references at the same commit [merged]
#518 - fix(create-issues-from-todos): avoid unpinned retry wrapper [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!