pr-issue-linkage: exempt bot-authored PRs (dependabot/renovate) via a login-allowlist input

[kyle-sexton]

Problem

The shared pr-issue-linkage reusable fails every bot-authored PR: dependabot / renovate / sync-bot
PR bodies carry no ## Related section and no closing keyword, so the check fails and holds
mergeStateStatus=UNSTABLE indefinitely — blocking the merge gate on an otherwise-ready PR. This
recurs on every dependency/sync PR across all consumer repos (each ships dependabot.yml and
enforces the gate).

Evidence: dependabot PRs #357 / #358 in melodic-software/claude-code-plugins; retrospective
.work/handoffs/babysit-autopilot-retro.md §1.1.

Why the fix belongs in the check (not the PR body)

melodic-standards-sync[bot] already complies by emitting the marker in its generated body
(PR #146). dependabot and renovate cannot inject a ## Related section into their PR bodies, so a
body-template fix is impossible for them — the exemption must live in the check.

Approach (decided)

Add a bot-author short-circuit to the reusable's inline github-script:

• New workflow_call input bot-author-logins (comma-separated; default the known bots:
  dependabot[bot], renovate[bot], melodic-standards-sync[bot]).
• When github.event.pull_request.user.login is in that set, pass the check before body validation.
• Env-pass the login into the script — never splice it into the script text (matches the existing
  PR_BODY handling).

Login equality is GitHub's documented dependabot-detection idiom (user.login == 'dependabot[bot]').
Chosen over a blanket user.type == 'Bot' / [bot]-suffix exemption: explicit, auditable, no silent
skip for an unknown future bot on a merge gate.

Files

• .github/workflows/pr-issue-linkage.yml — input + short-circuit
• .github/scripts/pr-issue-linkage.test.cjs — bot-author-passes + human-still-fails cases
• README.md — document the new input

Ownership / propagation

The reusable is owned here — GitHub Actions adoption is intentionally NOT a standards
sync-manifest managed component; per-repo caller workflows are locally-owned. Consumers pick up the
change by bumping their pinned reusable SHA (their normal Actions-pin path).

Verification

Extend pr-issue-linkage.test.cjs: a dependabot[bot] PR with no ## Related passes; a human PR
with no linkage still fails. Run the repo's JS test task.