Confirm mif-rs's branch-protection bypass allowance (real dependabot App slug) is intentional, not drift

[zircote]

What

While reconciling the stale modeled-information-format-ci bypass-allowance drift (#80), mif-rs's live main branch protection was found to carry a different bypass pattern than every other checked repo:

GET /repos/modeled-information-format/mif-rs/branches/main/protection
  .required_pull_request_reviews.bypass_pull_request_allowances.apps
  -> [{"slug": "dependabot", "id": 29110, ...}]  # the real, official GitHub Dependabot App

Every other repo checked (MIF, doc-site, structured-madr, ontologies) carried the stale modeled-information-format-ci entry (now reconciled to empty per #80) — none carried a dependabot bypass. mif-rs is the only repo seen with this shape.

Why it matters

This could be either:

1. Intentional — a deliberate per-repo choice to let the real dependabot App bypass review for mif-rs's own Dependabot PRs (consistent with the existing workspace convention captured in memory branch-protection-script-stale-app.md: "use dependabot slug + allow_auto_merge=true for repos with Dependabot auto-merge"), or
2. Drift — an artifact of some other provisioning path that should be reconciled to the same "no bypass, automerge App approves" pattern branch-protection.sh stamps the retired modeled-information-format-ci App into bypass_pull_request_allowances #80 establishes as the org norm.

Note: a worktree already in this workspace (worktrees/dot-github-issue-667, branch fix/667-retire-stale-bypass-app, uncommitted) independently parameterizes branch-protection.sh with a BYPASS_APPS env var defaulting to "dependabot" — a third, still-uncommitted design that would make (1) the org-wide default rather than mif-rs-specific. That branch and #80's approach (empty allowance, no parameterization) are not reconciled with each other; whoever picks this issue up should resolve that inconsistency too rather than triage mif-rs in isolation.

Ask

A human (or a follow-up session with the mif-rs maintainer's context) should confirm whether mif-rs's dependabot-slug bypass is intentional and, if so, whether it should become the documented org pattern for repos with Dependabot auto-merge — reconciling with the BYPASS_APPS design already drafted in the fix/667-retire-stale-bypass-app worktree — or whether it should be reconciled to an empty allowance like the other four repos.

Repro

gh api /repos/modeled-information-format/mif-rs/branches/main/protection \
  --jq '.required_pull_request_reviews.bypass_pull_request_allowances.apps[].slug'
# -> dependabot