chore: standardize squad governance workflows

.github/workflows/squad-dependabot-auto-merge.yml

@@ -0,0 +1,45 @@
+name: Dependabot Auto-Merge
+
+on:
+  pull_request_target:
+    types: [opened, reopened, synchronize, ready_for_review]
+    branches: [dev]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  enable-auto-merge:
+    if: >-
+      github.event_name == 'pull_request_target' &&
+      github.event.pull_request.user.login == 'dependabot[bot]' &&
+      github.event.pull_request.base.ref == 'dev' &&
+      github.event.pull_request.draft == false
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/github-script@v9
+        with:
+          script: |
+            const pullRequestId = context.payload.pull_request.node_id;
+            const pullNumber = context.payload.pull_request.number;
+            try {
+              await github.graphql(
+                `mutation EnableAutoMerge($pullRequestId: ID!) {
+                   enablePullRequestAutoMerge(input: { pullRequestId: $pullRequestId, mergeMethod: SQUASH }) {
+                     pullRequest { number }
+                   }
+                 }`,
+                { pullRequestId }
+              );
+              core.info(`Enabled auto-merge for PR #${pullNumber}.`);
+            } catch (error) {
+              const message = error.message ?? String(error);
+              if (message.includes("already enabled")) {
+                core.info(`Auto-merge already enabled for PR #${pullNumber}.`);
+                return;
+              }
+              throw error;
+            }
+

.github/workflows/squad-main-from-dev-guard.yml

@@ -0,0 +1,23 @@
+name: guard-main-source
+
+on:
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  guard-main-source:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/github-script@v9
+        with:
+          script: |
+            if (context.eventName !== "pull_request") {
+              core.info("Not a pull_request event.");
+              return;
+            }
+            const source = context.payload.pull_request.head.ref;
+            if (source !== "dev") {
+              core.setFailed(`PRs to main must come from dev. Current source: ${source}`);
+            }
+

.github/workflows/squad-standard-lint-markdown.yml

@@ -0,0 +1,24 @@
+name: lint-markdown
+
+on:
+  pull_request:
+    branches: [dev, main]
+  workflow_dispatch:
+
+jobs:
+  lint-markdown:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v5
+        with:
+          node-version: "20"
+      - name: Run markdownlint
+        run: |
+          files=$(git ls-files '*.md')
+          if [ -z "$files" ]; then
+            echo "No markdown files found."
+            exit 0
+          fi
+          npx --yes markdownlint-cli $files
+

.github/workflows/squad-standard-lint-yaml.yml

@@ -0,0 +1,25 @@
+name: lint-yaml
+
+on:
+  pull_request:
+    branches: [dev, main]
+  workflow_dispatch:
+
+jobs:
+  lint-yaml:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.x"
+      - name: Run yamllint
+        run: |
+          python -m pip install --quiet yamllint
+          files=$(git ls-files '*.yml' '*.yaml')
+          if [ -z "$files" ]; then
+            echo "No YAML files found."
+            exit 0
+          fi
+          yamllint -s $files
+