[LOC-7188] Enable Dependabot auto-merge automation

[JiNexus]

Summary

• Adds .github/workflows/dependabot-automation.yaml: on Dependabot PRs,
  reads update metadata via dependabot/fetch-metadata and, for minor/patch
  only, approves with GITHUB_TOKEN and enables squash auto-merge
  (gh pr merge --auto --squash). Major updates are never auto-merged.
• Updates .github/dependabot.yml: renames the grouped-PR block to
  all-dependencies and removes the major-version ignore rules so majors
  now open individual PRs for manual review.
• Updates .github/CODEOWNERS: excludes package.json and yarn.lock from
  code-owner review so the GITHUB_TOKEN approval is sufficient. .github/workflows/
  is intentionally NOT excluded (security policy), so workflow bumps still need a human.
• Uses the repo's own GITHUB_TOKEN (no machine user/PAT). The workflow-level
  permissions: contents/pull-requests: write is what elevates Dependabot's
  default read-only token.
• Adds a lightweight CircleCI e2e check that proves the built add-on still
  installs, builds, loads, renders and wires IPC after dependency bumps.
• Adds a jest harness under test/ that loads the compiled lib/ entry points
  with the Local runtime and Electron mocked, exercising the real
  @getflywheel/local-components + React in jsdom.
• Updates sonar-project.properties (sonar.tests=test) so Sonar classifies the
  relocated tests correctly.

E2E check

• .circleci/config.yml: single e2e job on cimg/node:22.15 (Linux) —
  yarn install --frozen-lockfile -> yarn build -> yarn test --ci, with a
  yarn.lock cache. No secrets, no browser.
• test/main.test.js: the update-site-notes IPC handler registers and persists notes.
• test/renderer.test.js: hooks register, Notes renders (empty + existing), and
  add-note syncs over IPC.
• test/mocks/*, test/setup.js, jest.config.js: Local/Electron mocks, jsdom
  polyfills, and harness config.
• tsconfig.json / .npmignore: keep tests out of the compiled lib/ and the
  published add-on package.

How it works

1. Dependabot opens a grouped minor/patch PR.
2. This workflow approves it and marks it for auto-merge.
3. CircleCI runs the e2e job, reporting the ci/circleci: e2e status check.
4. GitHub merges it once the branch's required checks (and approvals) pass.

Required repo settings (not in code)

• Enable Allow auto-merge (Settings → General → Pull Requests)
• Enable Allow GitHub Actions to create and approve pull requests (Settings → Actions → General)
• Connect getflywheel/local-addon-notes as a project in CircleCI
• Add ci/circleci: e2e as a required status check on master

gh pr merge --auto queues the merge and only completes once all
branch-protection requirements are met (required approvals + required status
checks). Until ci/circleci: e2e is required, the test runs but does not gate
the merge.

Test plan

Dependabot automation:

• Confirm the workflow runs on a Dependabot PR and the dependabot check passes
• Confirm a minor/patch Dependabot PR is approved and auto-merged once required checks pass
• Confirm a major Dependabot PR is NOT approved/auto-merged
• Confirm a .github/workflows/ bump is NOT auto-approved (still requires human review)

E2E:

• yarn install --frozen-lockfile && yarn build && yarn test passes locally
• The CircleCI e2e job runs and ci/circleci: e2e appears on this PR
• After making it required, a minor/patch Dependabot PR waits for ci/circleci: e2e before merging

Reference

• LOC-7188

[sonarqube-wp-engine-prod]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube