[vannt-dev]

What changes for users

• New opt-in switch modules.automerge (off by default, in no preset). It writes
  .github/workflows/automerge.yml, which calls the new reusable workflow dependabot-automerge.yml on
  Dependabot's pull requests. The reusable workflow reads the update with dependabot/fetch-metadata
  (SHA-pinned here, so this repo's Dependabot keeps it fresh) and runs gh pr merge --auto for
  patch and minor updates only. A major, or a group that holds one, stays manual.
• Auto-merge waits for what the default branch requires (required checks, required reviews). The
  workflow leaves auto-merge off, with a warning, when the branch requires neither, because auto-merge
  would then merge before CI has run.
• strict preset: the module stays off. Turned on by hand under strict, the ruleset's one required
  approval still gates the merge: the workflow never approves.
• New setting github.merge.auto_merge (maps to allow_auto_merge). github apply turns it on while
  the module is on. The module together with auto_merge: false is refused when the config is read.
• Optional Dependabot secret AUTOMERGE_TOKEN. With GITHUB_TOKEN, the merge's push starts no
  workflow on the default branch. This is documented.
• The merge method is the first one github.merge allows: squash, then merge, then rebase.
• GitLab: writes nothing and prints a note (Renovate has its own automerge).
• init prints a next step to run github apply. init -i and the playground offer the switch, and
  the playground adds github apply to the commands, with the "needs repokeeper 0.11.0" note.
• Docs: README, docs/ci-and-releases.md#dependabot-auto-merge, docs/github-settings.md.
• The standard stays 1.4.4: output without the switch does not change.

Rebased onto main after #74. The module and question order is now cache_cleanup, then automerge.
A second commit gives the slow Renovate image test in platforms-gitlab-stacks.test.ts 60 s instead
of 20 s: it runs one init per fixture (about 5 s locally) and timed out on windows-latest for #74.

Verification

• npm run typecheck, biome check ., npm test (505 passed after the rebase), npm run build: all pass.
• Ran node dist/cli.js init on sample node repositories with automerge: true: one with
  merge: { squash: false } (gets merge-method: merge) and one with workflows.source: local and
  cache_cleanup on as well (the reusable copy is seeded). actionlint 1.7.12 reports nothing for the generated workflows or for
  dependabot-automerge.yml.
• Not run against a real Dependabot pull request: that needs this merged and released first.