Summary

• .github/workflows/dependabot-automerge.yml was rewritten to the current pull_request_target policy (empty top-level permissions, job-scoped contents/pull-requests write, security/patch/actions eligibility, release-tooling denylist), but tests/ci/dependabot-automerge-contract.test.ts still encoded the pre-rewrite contract.
• That stale contract failed App frontend build / test on main and every Dependabot PR. tauri-build-smoke then skipped via needs.app-frontend.result != 'failure', and CI Gate failed both jobs.
• Update the contract tests to assert the actual security model that is implemented — no CI weakening, no skipped checks.

Root cause (failing assertions on main)

1. auto-merge is limited to semver patch and minor — test forbade any third version-update:semver-* string; workflow correctly uses semver-major as an exclusion for github-actions bumps.
2. denylists native audio... crates — test expected a crate DENYLIST:; workflow denylists googleapis/release-please-action / dependabot/fetch-metadata.
3. keeps top-level permissions read-only — test expected contents: read; workflow intentionally uses permissions: {} + job-scoped write.

Verification

• Local: CI=true node --run test -- --coverage → 212 files / 2371 tests passed; coverage above thresholds (83.5/76.6/79.5/84.4 vs 65/60/60/60).
• Pre-push lefthook: lint, format, knip, standards-route, patch-coverage all green.

Updates the Dependabot auto-merge contract tests to match the current workflow.

The tests now verify:

• pull_request_target security behavior.
• Empty top-level permissions.
• Job-scoped contents and pull-requests write permissions.
• Same-repository Dependabot heads.
• No pull-request checkout.
• Eligibility for security, patch, non-production minor, and non-major github-actions updates.
• Denylists for release-please-action and fetch-metadata.
• Removal of obsolete native crate denylist assertions.