fix(ci): skip claude-review for bot-authored PRs and serialise the Dependabot merge train

[JayVDZ]

Description

Retrospective fixes from the July 2026 Dependabot batch (nine PRs merged over ~24 hours):

• claude-code-review.yml: skip the AI review when the PR author is dependabot[bot] or jim-automation[bot], not just when the actor is. Maintenance pushes to a bot's PR branch (lock-file regeneration, update-with-main) make the human pusher the actor, which un-skipped the review on PRs it was designed to skip and burned a doomed review run per push.
• review-dependabot skill, Step 6: rewritten as a serial merge train; one PR at a time, branch update and lock-file regeneration combined into a single push, auto-merge (squash), wait for merge before touching the next PR. Deletes the "after each merge, comment ·@·d·ependabot r·ebase on the remaining PRs" guidance (roughly N²/2 CI runs per batch of N, against a floor of N). Adds a merge-from-main fallback for branches with external commits or an unresponsive Dependabot, plus update hygiene learned the hard way: verify dotnet restore exit status as its own command, and grep for leftover conflict markers before committing.

Type of change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Refactor (no functional change)
• Other (describe below): CI workflow and dev-tooling (skill) optimisation

Testing

• Workflow YAML and Markdown only; no build/test applies (per repo build/test exceptions)
• Workflow condition logic mirrors the existing actor checks with the author term added to each expression

Documentation

• No documentation needed

Docs: n/a - CI workflow and internal skill tooling; no user-facing behaviour change

Screenshots / output (if applicable)

n/a

Checklist

• My commit messages are descriptive and reference the relevant Issue (if any)
• My code follows the conventions in docs/DEVELOPER_GUIDE.md
• User-facing text uses British English (en-GB)
• This PR does not include security-sensitive information (real credentials, customer data, internal hostnames)

Additional context

The claude-review check is currently removed from the ruleset's required checks (its CLAUDE_CODE_OAUTH_TOKEN is dead); once the token is refreshed and the check re-added, this change ensures Dependabot PRs satisfy it via the skip path regardless of who pushes to them.

🤖 Generated with Claude Code

https://claude.ai/code/session_01SmxijKgLk22PXG2benH2i4

---

Generated by Claude Code

[JayVDZ]

@claude Please reply with just the word "verified". This is a credential test for the refreshed CLAUDE_CODE_OAUTH_TOKEN secret.

---

Generated by Claude Code

[claude]

Claude finished @JayVDZ's task in 7s —— View job

---

verified