Pilot: actionlint CI gate + Dependabot auto-merge caller

[aaronelliotross]

First end-to-end pilot of the Dependabot auto-merge rollout (Monday board "Dependency Remediation — June 2026", group "AUTO"). ci-workflows is the lowest-risk repo — its only Dependabot updates are github-actions version bumps.

Adds

• .github/workflows/ci.yml — PR gate. ci-workflows holds only reusable (workflow_call) workflows that can't self-run on a PR, so the gate is actionlint over the workflow files. The job is named ci, producing a status check named ci — the exact context the org ruleset will require.
• .github/workflows/automerge.yml — caller for the reusable added in Add reusable Dependabot auto-merge workflow #6, pinned to @v13. (Named automerge.yml, not dependabot-auto-merge.yml, because this repo already hosts the reusable at that path.) Runs only on dependabot[bot] PRs and enables native auto-merge for semver-patch/semver-minor.

Still required for auto-merge to actually fire (separate, after merge)

1. Enable Allow auto-merge on this repo's settings.
2. Apply the org ruleset scoped to ci-workflows only (require PR + ci check on main, Core team bypass). The ruleset is what gives gh pr merge --auto something to wait on.

Once those two are in place, the next github-actions Dependabot PR here should merge itself after ci goes green.