ci: enable dependabot auto-merge for StartOS companion dependencies

[TrezorHannes]

Summary of Changes

This PR resolves the issue where Dependabot PRs for StartOS companion packages (cln-startos, lnd-startos) were not auto-merging:

1. Auto-Merge Workflow Alignment:

   • Updated .github/workflows/dependabot-auto-merge.yml to explicitly match git commit updates for cln-startos and lnd-startos alongside SemVer minor/patch and GitHub Actions updates.
   • Preserves fail-closed gate: auto-merge only triggers after all 3 package build & test checks succeed 100%.

2. Dependabot Grouping:

   • Added startos-packages grouping in .github/dependabot.yml to bundle cln-startos and lnd-startos updates into a single consolidated PR instead of multiple separate PRs.

3. Automated Verification:

   • Added tests/ci_auto_merge.test.ts verifying dependabot configuration, eligibility guards, and approval/merge condition equivalence.
   • All 30 TS unit tests, 28 Python unit tests, and 18 BATS tests passing cleanly.
   • Local Greptile Review passed with 5/5 Confidence Score (0 comments).

[greptile-apps]

Greptile Summary

The PR enables grouped Dependabot updates and auto-merge eligibility for the StartOS companion packages while retaining the existing build gate.

• Adds a startos-packages Dependabot group for cln-startos and lnd-startos.
• Extends approval and auto-merge predicates to companion-package commit updates and eligible GitHub Actions updates.
• Adds AST-based configuration tests that evaluate the parsed workflow condition.
• Declares and locks the YAML parser required by the new test.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
.github/dependabot.yml	Adds the companion dependencies to a dedicated Dependabot update group.
.github/workflows/dependabot-auto-merge.yml	Expands identical approval and merge predicates to the intended companion and GitHub Actions updates.
tests/ci_auto_merge.test.ts	Parses both YAML configurations structurally and evaluates the workflow predicate from the parsed condition.
package.json	Declares the YAML parser needed by the new CI-policy test.
package-lock.json	Locks the newly declared YAML development dependency consistently.

_{Reviews (3): Last reviewed commit: "build(deps): add yaml devDependency and ..." | Re-trigger Greptile}

[TrezorHannes]

@greptile-apps All feedback has been resolved in commit 5b2b7d7: replaced text-only assertions with full YAML AST parsing and boolean semantic evaluation. Please perform a targeted re-review on the latest commit.

[TrezorHannes]

@greptile-apps All feedback has been resolved in commit 14cd266: added yaml to devDependencies in package.json, regenerated lockfile, and refactored test to evaluate parsed condition expression directly. Please perform a targeted re-review on the latest commit.