Automate Dependabot PR handling with Copilot coding agent

.github/copilot-dependabot-instructions.md

@@ -0,0 +1,11 @@
+@copilot This PR was opened by Dependabot. Please take it the rest of the way before it's ready for human review:
+
+1. **Impact analysis** — identify what changed (package name, old → new version) from the PR diff/description, search the codebase for where that dependency is actually used, and summarize what could be affected.
+2. **Fix build/conflict issues** — run `npm ci --legacy-peer-deps`, `npm run build`, and `npm run lint`; resolve any merge conflicts, build errors, or lint errors that surface.
+3. **Tests** — add or update tests under `tests/**` to cover the changed usage, and make sure they meaningfully validate the change (not just re-assert the version bump).
+4. **Run the suite** — run the relevant `npm run test:*` script(s) for the affected area (e.g. `test:blob`, `test:queue`, `test:table`) and keep fixing until they pass.
+5. **Changelog** — append one bullet to `ChangeLog.md` under `## Upcoming Release` → `General:`, matching the existing style and tone of the entries already there (package name in backticks, old → new version, why, and a one-line summary of any code changes made).
+6. **Comments** — review any existing PR comments and review threads, including resolved/hidden ones, and address anything actionable.
+7. **Self-rate** — rate this work 1-10 against: correctness, test coverage, changelog accuracy, build/lint health, and comment resolution.
+8. **Iterate** — if it's not a 10, keep improving until it is before finishing.
+9. **Summary** — post a final comment explaining why this update matters, what the impact/risk is, and what could go wrong if it weren't applied, along with your self-rating and reasoning.

.github/workflows/copilot-dependabot-agent.yml

@@ -0,0 +1,38 @@
+name: Copilot Dependabot Agent
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: "PR number to (re)assign to Copilot"
+        required: true
+
+permissions:
+  pull-requests: write
+  contents: read
+
+jobs:
+  assign-copilot:
+    if: ${{ github.event_name == 'workflow_dispatch' || github.actor == 'dependabot[bot]' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Determine PR number
+        id: pr
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "number=${{ inputs.pr_number }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "number=${{ github.event.pull_request.number }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Ask Copilot to work the PR
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          PR_NUMBER: ${{ steps.pr.outputs.number }}
+        run: gh pr comment "$PR_NUMBER" --body-file .github/copilot-dependabot-instructions.md

.github/workflows/dependabot-conflict-recheck.yml

@@ -0,0 +1,26 @@
+name: Dependabot Conflict Recheck
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+  pull-requests: read
+  actions: write
+
+jobs:
+  recheck:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Re-dispatch Copilot on conflicting Dependabot PRs
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          sleep 20
+          gh pr list --repo "$GITHUB_REPOSITORY" --app dependabot --state open --limit 100 \
+            --json number,mergeable --jq '.[] | select(.mergeable == "CONFLICTING") | .number' \
+          | while read -r n; do
+              echo "Re-dispatching Copilot for conflicting PR #$n"
+              gh workflow run copilot-dependabot-agent.yml --repo "$GITHUB_REPOSITORY" -f pr_number="$n"
+            done