* ci: merge owner-approved PRs automatically after checks pass
Approval by the repo owner on a PR should be the only manual step before
merge. The auto-merge workflow squash-merges open PRs the owner approved
at their current head once every required check's latest run on that
head has passed (test, integration, windows-codex-mcp).
Fork PR review events receive no secrets, so a no-op signal workflow
runs on pull_request_review and its completion triggers the privileged
workflow, which runs default-branch code. Merges use AUTO_MERGE_TOKEN, a
user token, so the resulting pushes to main trigger push workflows; the
workflow refuses to merge if that secret is missing.
* ci: load the auto-merge script from main on every trigger
workflow_dispatch checks out the ref chosen by the caller, so a manual
run from a topic branch would execute unmerged merge logic with the
owner's token. Pin the checkout to main.
