fix(ci): close review-flagged gaps in dependabot-auto-merge.yml

[smartwatermelon]

Summary

Fixes the four auto-filed non-blocking review findings from PR #39's fleet remediation work, applied directly to this repo's dependabot-auto-merge.yml and scripts/drop-noop-approve-step.sh:

• Major bump path doesn't fail-safe when DEP_NAMES is empty but omits the empty-check guard path #41 — major-bump path now fails closed when dependency-names parses to an empty set from non-empty (whitespace/comma-only) input, instead of treating it as an implicitly-trusted empty remainder.
• github.event.pull_request.user.login widens who can trigger auto-merge on Dependabot PRs #40 — switches the job's bot-actor gate from the spoofable github.actor to github.event.pull_request.user.login; documents the resulting synchronize-trigger tradeoff rather than hiding it.
• clone-err.log is a shared, non-reset file — stale error content survives across repos on successful clones #38 — resets clone-err.log per repo in both fleet scripts instead of leaving stale content from a prior repo's failed clone.
• commit_msg_file and pr_body_file are written inside the loop but to fixed paths — wasted writes per iteration #37 — hoists the commit-message/PR-body template writes out of the per-repo loop in drop-noop-approve-step.sh.

Also, while fixing this file directly:

• Drops the now-fully-inert gh pr review --approve step (dev-env#21 — no repo in the fleet requires an approving review).
• SHA-pins dependabot/fetch-metadata and suppresses the intentional pull_request_target trigger finding, both caught by the local zizmor pre-commit hook.
• Adds scripts/retry-noop-approve-zizmor-fixes.sh, the follow-up script for the 20 fleet repos whose original drop-noop-approve-step.sh run hit the same zizmor findings — dev-env is excluded from its repo list since this PR fixes it in place.
• Corrects a stale comment claiming pre-commit hooks don't run in scratch clones (they do, via machine-global core.hooksPath — that's what caused the 20-repo zizmor failures) and a PR-body claim that removing the approve step also drops pull-requests: write usage (it doesn't; gh pr merge --auto needs it too) — closes Stale hook comment in drop-noop-approve-step.sh claims hooks don't run in scratch clones #42, PR body text claims removing the approve step eliminates pull-requests:write, but the permission is retained #43.
• Surfaces the gh pr create error detail in terminal output, matching every other failure path in the script — closes gh pr create error detail silently dropped in drop-noop-approve-step.sh #44.

Two more non-blocking findings (#45, #46) were auto-filed during this branch's own push reviews. Left open for a follow-up pass rather than chased further here — diminishing returns on a docs/tooling-only branch.

Test plan

• bash -n syntax check on both shell scripts
• zizmor clean on dependabot-auto-merge.yml (was 3 findings, now 0)
• Local pre-commit review (code-reviewer + adversarial-reviewer) passed on every commit
• Local pre-push full-diff + codebase review passed on every push

Closes #41, #40, #38, #37, #42, #43, #44.

https://claude.ai/code/session_01SsnvQEpWgMxcRocq8bBVSE