Harden Dependabot auto-merge and coverage publishing

[Snuffy2]

Summary

Hardens Dependabot auto-merge authorization and separates untrusted coverage generation from trusted coverage publication. This keeps dependency updates convenient while ensuring write-capable jobs act only on verified repository-controlled inputs.

What Changed

• Added a trusted-base JavaScript authorizer for Dependabot provenance, changed-file scope, verified commit history, and GitHub Update branch ancestry.
• Reworked the auto-merge workflow to run authorization with read-only permissions before enabling or disabling auto-merge.
• Required Dependabot authorization before checking out dependency PR heads in pytest CI.
• Split coverage processing into read-only PR generation and trusted default-branch publication paths with narrowly scoped permissions.
• Added behavior-level tests for supported ecosystems, malformed or untrusted histories, workflow permissions, release gates, and coverage publication.

Why

Dependabot PRs and coverage artifacts cross trust boundaries in CI. Verifying their provenance and contents from the trusted base before executing or granting write access reduces the risk of untrusted changes reaching privileged workflow paths while preserving automated dependency maintenance.

[github-actions]

Coverage report

This PR does not seem to contain any modification to coverable code.