[mrz1836]

What Changed

• GO_PRE_COMMIT_VERSION: v1.13.0 → v1.13.1 (.github/env/10-pre-commit.env)
• Added DEPENDABOT_AUTO_MERGE_PATCH_THIRD_PARTY = true (.github/env/20-workflows.env)
• MAGE_X_VERSION: v1.29.3 → v1.29.4 (.github/env/10-mage-x.env)
• Reworked auto-merge-trigger.yml into the single unprivileged entry point for PR automation. It holds no permissions, adds many more pull_request event types plus dismissed reviews, and gains jobs that queue the Dependabot Auto-merge and PR Management workflows alongside Auto-merge on Approval.
• Updated the auto-merge, Dependabot auto-merge and PR management workflows, plus the related docs and tech conventions. These diffs were trimmed, so they are only described generically here.
• Bumped the pinned github/codeql-action SHA from the v4.38.3 commit to the v4.39.0 commit in the CodeQL analysis, security scans and scorecard workflows. The new setting in 20-workflows.env also gains explanatory comments, including a recommended Dependabot cooldown supply-chain control.

Why It Was Necessary

• Keeps the repository's shared workflow, env and documentation files in line with the upstream source of truth.
• The trigger workflow comments say the new workflow_run design replaces pull_request_target, which GitHub disables by default on public repositories without an Actions event policy allowing it (enforced from 2026-11-02).
• Third-party patch updates can now auto-merge by default, mirroring the existing minor-update setting.

Testing Performed

• The diff was reviewed for the env, CodeQL, security scan and scorecard changes. The large workflow and doc diffs were trimmed and not inspected in detail.
• No test runs are shown in this diff. Validation relies on the repository's CI checks, including workflow linting, running on this PR.
• Behavior of the new trigger and consumer workflows should be confirmed on real Dependabot, fork and same-repo PRs after merge.

Impact / Risk

• Behavior change: With DEPENDABOT_AUTO_MERGE_PATCH_THIRD_PARTY=true, non-security third-party patch updates auto-merge without manual review. Major updates stay manual. Security updates keep their own rule, and merge guards and required status checks still apply. Set the value to false to restore manual review.
• Regression risk: Medium. The workflow rewrites are large (over 1,000 changed lines in the Dependabot auto-merge workflow alone) and change how PR automation is triggered. Job names must stay in sync between the trigger and its consumers.
• Low risk: The CodeQL action, pre-commit tool and MAGE-X bumps are patch or minor updates and limited to CI tooling.