ADR-069: Dependabot updates merge themselves, except where held for a person

Dependabot proposes dependency updates against next, like every other change (ADR-066), and .github/workflows/dependabot-automerge.yml approves and rebase-merges them once CI is green. A green run is accepted as sufficient evidence that an update is safe, without a person reading the diff. Four kinds are held for a person instead: a major version bump, an update whose type does not parse, the Bitbucket product image whatever its update type (ADR-042), and a pull request not based on next. One based elsewhere is usually a security update, which Dependabot opens against main whatever its configuration says; it is retargeted to next, not merged there. Every GitHub Action is pinned to the full commit of a release, with the release named in a comment beside it. A tag can be moved by whoever owns it, and the release workflow runs with a token that publishes signed binaries; a commit cannot be moved. Dependabot reads the comment and proposes the next release as a new commit, so a pinned action stays in the automated stream. Ecosystems, schedules and grouping live in .github/dependabot.yml, and the exact holds in the workflow.

Do not add a dependency exception to this record; add it to the workflow, where it is executable. Do not weaken a CI gate to get an update through: the gate is what auto-merge trusts. Pin a new action the same way, as owner/action@<full commit> # vX.Y.Z, where the commit is the one the release tag points to (follow an annotated tag to its commit). TestEveryActionIsPinnedToACommit fails on a tag, a short SHA, or a commit with no release named beside it.

Auto-merge is only defensible where the gate is. Every pull request here runs the live suite against a real Bitbucket (ADR-043) and must clear the coverage gates (ADR-065), so a green run exercises the dependency rather than merely compiling against it. Reading the diff of a patch bump adds little to that, and doing it for every proposal adds enough friction that updates accumulate, which is the outcome the policy exists to avoid. The held set is where a green run is not the whole question. A major bump can be green and still change behaviour a reader should see, and the product image tag is a claim about what this project supports rather than a dependency of its build.