fix(ci): stop the auto-heal loop stranding every npm Dependabot PR

[countgitmick]

Seven npm Dependabot PRs (#227, #229 to #235) are stuck and cannot merge. The auto-heal workflow is not failing to run. It heals every PR, proves the build is green, and then dies at the merge step. Four causes stack up.

1. The heal commit stops the Dependabot rebase

Dependabot stops rebasing a pull request as soon as a third party pushes a commit to it. The build(flake): recompute fetchYarnDeps hash commit is that push. #228 merged at 21:39 on 1 August, the seven siblings conflicted inside the same minute, and nothing ever cleared them.

Fix: the heal commit message now carries [dependabot skip], the documented marker that lets Dependabot force-push a rebase over a third-party commit.

2. Every npm PR fights every other npm PR

Each one rewrites yarn.lock and the same single hash = line in flake.nix. Two open npm PRs are never clean at the same time.

Fix: a catch-all group puts every npm version update in one PR. That removes the race, and it cuts the cost from one full nix build per package to one per week. applies-to: version-updates keeps security updates on their own PRs.

3. The healed head commit carries no checks

A push made with the default GITHUB_TOKEN never starts another workflow run. commits/<branch>/check-runs returns total_count: 0 on all seven PRs. batch-deps.yml documented this exact trap in its own header, and the heal workflow repeated it.

Fix: the checkout and merge steps read secrets.AUTOHEAL_TOKEN and fall back to GITHUB_TOKEN when it is unset. It has to be stored as a Dependabot secret, because a Dependabot-triggered run cannot read Actions secrets. The workflow header explains this.

4. The --auto fallback can never arm

GraphQL: Pull request Branch does not have required protected branch rules

GitHub refuses to arm auto-merge on a branch with no merge requirement. development has neither a required status check nor a required review, so the call failed the job on every conflicting PR.

Fix: drop the fallback. A conflict is now logged and passes, because Dependabot rebases it.

batch-deps removal

batch-deps.yml ran yarn upgrade every Monday and pushed package.json, yarn.lock and flake.nix straight to development. Dependabot npm runs weekly against the same three files. Two updaters on one lockfile meant every Monday push turned each open npm PR dirty. The catch-all group now does that job through a reviewed PR with real CI.

After merge

Do not close the seven stuck PRs by hand. A manual close stops Dependabot recreating that version. Comment @dependabot recreate on them instead, or let the next weekly run supersede them with the grouped PR.

Checks run

actionlint with shellcheck exits 0. Both YAML files parse.