[mrz1836]

What Changed

• GO_PRE_COMMIT_VERSION: v1.13.0 → v1.13.1 (.github/env/10-pre-commit.env)
• MAGE_X_VERSION: v1.29.3 → v1.29.4 (.github/env/10-mage-x.env)
• Added DEPENDABOT_AUTO_MERGE_PATCH_THIRD_PARTY = true (.github/env/20-workflows.env)
• Reworked auto-merge-trigger.yml into a single unprivileged entry point for PR automation. It now fires on more PR event types and on review dismissals. It has separate wake-up jobs for "Auto-merge on Approval", "Dependabot Auto-merge", and "PR Management". The comments say this replaces pull_request_target.
• Updated the auto-merge-on-approval.yml, dependabot-auto-merge.yml, and pull-request-management.yml workflows, which are trimmed in the diff, so only their size and type of change can be stated. They are modified substantially.
• Updated the 20-workflows.env comments to describe how third-party patch updates are handled. Pinned the github/codeql-action references in the CodeQL, security scan, and scorecard workflows to the v4.39.0 commit (previously v4.38.3). Also modified the auto-merge docs and the workflow tech conventions (trimmed in the diff, so not described in detail).

Why It Was Necessary

• Keeps the synced workflows, env settings, and documentation in line with the upstream source of truth.
• Moves PR automation onto a workflow_run model, so Dependabot and fork PRs no longer depend on pull_request_target, which the workflow comments say GitHub disables by default on public repositories without an event policy.
• Adds a configurable setting for third-party patch auto-merge, which mirrors the existing minor-update setting.

Testing Performed

• Not run locally. This is an automated file sync, and the diff contains no test changes.
• The workflows and env files should be validated by the repository's CI and workflow linting on this PR.
• Reviewers should check that the job names in the trigger workflow still match what the consuming workflows expect, since the comments say the names must stay in sync.

Impact / Risk

• Behavior change: With DEPENDABOT_AUTO_MERGE_PATCH_THIRD_PARTY=true (and unset also treated as true), non-security third-party patch updates can now auto-merge. Set it to false to send them to manual review.
• Workflow risk: The trigger and consumer workflows were rewritten substantially, so auto-merge, Dependabot, and PR management behavior may change. Watch the first few runs after merge.
• Low risk: The codeql-action pin and tool version bumps are routine updates.