fix(ci): arm dependabot auto-merge with an app token so the merge queue actually enrolls

[githubrobbi]

Problem

Dependabot PRs #40/#41 sat CLEAN with auto-merge enabled for 7+ hours and never merged. The timeline shows an AutoMergeEnabledEvent but no AddedToMergeQueueEvent — auto-merge armed via the default GITHUB_TOKEN never enrolls in the merge queue, per GitHub's anti-loop design (the same limitation release-plz.yml already documents for tag pushes). They needed a manual enqueuePullRequest nudge.

Fix

• Mint a GitHub App installation token via actions/create-github-app-token (SHA-pinned, v3.2.0) when APP_ID/APP_PRIVATE_KEY are configured, and arm gh pr merge --auto with it. Reuses the repo-wide app-credential names release-plz.yml designates as the canonical pattern.
• Fall back to GITHUB_TOKEN when the secrets are absent (fresh template clone) — identical to pre-fix behavior, zero regression.
• Header comment documents the root cause and the setup runbook, including the footgun that this workflow runs on Dependabot-actor events and therefore reads the Dependabot secrets store (gh secret set APP_ID --app dependabot), not the Actions one.

Verification

• actionlint clean (it caught that secrets isn't legal in step-level if:; hoisted to job-level env).
• Behavioral proof requires the app credentials + a live Dependabot PR; until the secrets are set, the mint step is skipped and the workflow is byte-for-byte the old behavior.