ci: drop the merge automation, leave Dependabot PRs to their owners

Deletes .github/workflows/dependabot-automerge.yaml and
.github/scripts/dependabot-automerge.sh, 372 lines and an hourly cron.

Unattended merging was never available: main's ruleset requires one code-owner
approval with zero bypass actors, and granting some identity the right to bypass
code-owner review on a public repository is not a trade worth making for dependency
bumps in demo applications. What was left after that decision merged an approved
pull request without a second visit — real, but not worth 372 lines and a workflow
holding contents: write, when a code owner is already in the loop and one click away.

So Verify Examples does what its name says and nothing more: it fails a Dependabot
pull request when the examples it touches do not build and boot, and a code owner
merges. Everything that carried the weight stays — the grouped config that turns 69
per-advisory pull requests into one per example app, the selector that verifies only
the examples a pull request touches, the drift guard that keeps both hand-maintained
lists honest, and examples-verified as the single result a reviewer reads before
merging.

Also cleans up the twelve comments across four files that described the merge
gate as the reason for a rule, since it no longer exists: the selector's
"select nothing" contract now rests on examples-verified treating a skipped job as a
pass, and the drift guard's matrix-name check on the selector choosing an example
whose directory is gone.

Suites re-run after the removal: the drift guard's clean tree plus a covering glob,
a missing applies-to, and an unclaimed spaced manifest; the selector's no-base,
empty-diff and single-example paths.

Author: bnusunny

.github/dependabot.yml

@@ -1,8 +1,8 @@
 # Dependabot configuration for the example applications.
 #
 # The adapter itself (Cargo.toml at the repo root) has an entry for its commit message
-# only. Version updates stay off and the auto-merge workflow refuses anything outside
-# examples/, so its dependencies are still reviewed by hand.
+# only. Version updates stay off, and every pull request here is reviewed and merged by
+# hand, so its dependencies keep the scrutiny they had.
 #
 # Why this file exists: without it, Dependabot opens one pull request per advisory per
 # manifest. That produced 69 open PRs, thirteen of them against the single lockfile in
@@ -12,13 +12,12 @@
 # Why one entry per example rather than one glob entry per ecosystem: `directories` with
 # a glob plus a group produces a single pull request spanning every matching directory —
 # the "Bump the npm group across 17 directories with 100 updates" form, of which there
-# are hundreds of thousands in the wild. That would be worse here on two counts. A bad
-# bump in one example would block the security fixes for every other example in the
-# group, and .github/workflows/dependabot-automerge.yaml refuses any pull request
-# touching an example that .github/example-matrix.json does not build and boot — most of
-# them — so a cross-directory pull request would essentially never auto-merge. One entry
-# per example makes "one pull request per example app" a property of the config instead
-# of an assumption about Dependabot's grouping behavior.
+# are hundreds of thousands in the wild. That would be worse here: a bad bump in one
+# example would block the security fixes for every other example in the group, and one
+# red matrix job would make a pull request spanning a dozen examples unreviewable — you
+# could not tell which bump broke which app without reading the logs. One entry per
+# example makes "one pull request per example app" a property of the config instead of an
+# assumption about Dependabot's grouping behavior.
 #
 # Why the directories are spelled out rather than globbed: Dependabot rejects a config
 # whose entries for one ecosystem it cannot prove have non-overlapping directories, and
@@ -41,10 +40,10 @@
 # Every group is named `security` rather than after its example, because Dependabot
 # builds the commit header from the group name and the directory, and commitlint caps the
 # header at 120 characters. `fastapi-backend-only-response-streaming-pip` against its own
-# 53-character directory produced a 137-character header — Commit Lint red, auto-merge
-# refusing on "checks are not all green", and a hand amend needed for exactly the
-# examples with the longest names. The name only has to be unique within its entry; the
-# directory in the header is what distinguishes the pull requests.
+# 53-character directory produced a 137-character header — a red Commit Lint check and a
+# hand amend needed for exactly the examples with the longest names. The name only has to
+# be unique within its entry; the directory in the header is what distinguishes the pull
+# requests.
 version: 2
 updates:
   # bundler
@@ -588,10 +587,10 @@ updates:
         patterns: ["*"]
 
   # cargo, the adapter itself rather than an example. Listed for the commit message
-  # only: the limit keeps version updates off, and dependabot-automerge.sh refuses
-  # anything touching files outside examples/, so an advisory here still gets a hand
-  # review — it just arrives with a header Commit Lint accepts. Pre-emptive: today's six
-  # open rust alerts are all in examples/rust-*-zip, which the entries above cover.
+  # only: the limit keeps version updates off, and an advisory here gets the same hand
+  # review as any other change to the adapter — it just arrives with a header Commit Lint
+  # accepts. Pre-emptive: today's six open rust alerts are all in examples/rust-*-zip,
+  # which the entries above cover.
   - package-ecosystem: cargo
     directories: ["/"]
     schedule:

.github/scripts/check-example-config.sh

@@ -16,9 +16,9 @@
 # examples/fastmcp and examples/sveltekit-ssr-zip are recent evidence that examples get
 # added regularly.
 #
-# A stale matrix name is quieter but worse: dependabot-automerge.sh treats a changed
-# example as covered when the matrix names it, so a renamed or deleted example would be
-# credited with coverage it does not have.
+# A stale matrix name is quieter: the selector would keep choosing an example that no
+# longer exists, and its job would fail on a missing working directory rather than on
+# anything to do with the change under review.
 set -euo pipefail
 
 cd "$(dirname "$0")/../.."

.github/scripts/dependabot-automerge.sh

@@ -13,8 +13,8 @@
 #     clone does not have, or a change to a shared input every example is built against.
 #   verify the examples in the diff — the normal pull request case.
 #   verify nothing — the diff is empty, or touches nothing under examples/. The
-#     `if: ... != '[]'` guards in examples.yaml skip the test jobs, and the auto-merge
-#     gate refuses a run in which the changed example's own job did not succeed.
+#     `if: ... != '[]'` guards in examples.yaml skip the test jobs, and examples-verified
+#     treats a skipped job as a pass, so the workflow is green with nothing to run.
 #
 # The diff base comes from the merge ref's first parent, not from BASE_SHA, for the
 # reason recorded below.
@@ -75,10 +75,9 @@ echo "$changed" | sed 's/^/  /'
 # Shared inputs every example is built against: the adapter itself, the layer wrapper,
 # this workflow, and the two scripts every test job actually runs.
 #
-# Named individually rather than as .github/scripts/, which now also holds
-# dependabot-automerge.sh and check-example-config.sh — neither of which any example is
-# built against, and matching the whole directory meant a one-line fix to the auto-merge
-# script rebuilt and booted all eighteen entries.
+# Named individually rather than as .github/scripts/, which also holds
+# check-example-config.sh — which no example is built against, so matching the whole
+# directory would rebuild and boot all eighteen entries for a change to it.
 if grep -qE '^(src/|layer/|Cargo\.toml$|Cargo\.lock$|\.github/workflows/examples\.yaml$|\.github/scripts/verify-http\.sh$|\.github/scripts/select-examples\.sh$|\.github/example-matrix\.json$)' <<<"$changed"; then
   echo "A shared path changed: verifying every example."
   emit_all
@@ -92,9 +91,8 @@ example_paths="$(grep -oE '^examples/[^/]+' <<<"$changed" || true)"
 
 # Reachable with an empty diff: a stale pull request whose change already landed
 # through a duplicate (#804 and #811 carry an identical update set), or a re-run after
-# the commit merged. "Select nothing" is the documented contract here, not "fail" —
-# the `if: ... != '[]'` guards in examples.yaml skip the test jobs, and the auto-merge
-# workflow refuses a run with no successful test job.
+# the commit merged. "Select nothing" is the documented contract here, not "fail" — the
+# `if: ... != '[]'` guards in examples.yaml skip the test jobs and the workflow is green.
 if [[ -z "$example_paths" ]]; then
   echo "No example changed: nothing to verify."
   for kind in image zip stream; do