[Sync] Update project files from source repository (cffc563)

[mrz1836]

What Changed

• GO_PRE_COMMIT_VERSION: v1.11.0 → v1.13.0 (.github/env/10-pre-commit.env)

• Added DEPENDABOT_AUTO_MERGE_PATCH_SAME_OWNER = true (.github/env/20-workflows.env)

• GOVULNCHECK_GO_VERSION: 1.27.1 → 1.27.2 (.github/env/00-core.env)

• MAGE_X_VERSION: v1.27.3 → v1.28.0 (.github/env/10-mage-x.env)

• MAGE_X_BENCHSTAT_VERSION_LATEST: v0.0.0-20260908200009-22c9c6c9d4da → v0.0.0-20260929162123-406019bb8b68 (.github/env/10-mage-x.env)

• Enhanced Dependabot auto-merge workflow with same-owner dependency detection step that verifies whether all updated dependencies are owned by the repository's GitHub owner before auto-merging production patch updates

• Reordered JSON fields in t3.json script definitions to place name field after icon field for all script entries

• Updated workflow comments and logging to document the new same-owner verification logic for production patch updates

Why It Was Necessary

• Updating tooling versions ensures access to latest bug fixes, security patches, and feature improvements in pre-commit hooks, vulnerability scanning, and build tooling
• The same-owner dependency check enables safer auto-merge policies by distinguishing first-party patch updates (which can be auto-merged) from third-party patches (which require manual review)
• Field reordering in t3.json maintains consistent JSON formatting and structure across the configuration file

Testing Performed

• Automated file synchronization was applied and validated against the schema definitions for all configuration files
• Version string format validation confirms all updated version numbers follow expected semantic versioning patterns
• GitHub Actions workflow syntax for the new same-owner detection step was validated for proper environment variable handling and shell script safety

Impact / Risk

• Low Risk: Version updates are incremental and within minor/patch ranges; tooling changes are non-breaking
• Low Risk: JSON field reordering is purely cosmetic and does not affect runtime behavior or parsing
• Medium Impact: The new same-owner auto-merge logic changes Dependabot behavior for production dependencies, but fails closed (requires manual review when verification fails) to prevent unintended auto-merges

[Copilot]

🔵 Needs a closer look

Auto-merging direct production dependencies changes a security-sensitive trust policy and warrants final human review.

0 open findings

What changed in this PR

Synchronizes project tooling and Dependabot automation with the source repository.

Changes:

• Updates Go tooling and benchmark versions.
• Adds same-owner production patch auto-merging with fail-closed verification.
• Normalizes t3.json field ordering.

File	Description
.github/​env/​00-core.env	Updates the govulncheck Go version.
.github/​env/​10-mage-x.env	Updates Mage-X and benchstat.
.github/​env/​10-pre-commit.env	Updates go-pre-commit.
.github/​env/​20-workflows.env	Enables same-owner patch auto-merging.
.github/​workflows/​dependabot-auto-merge.yml	Implements ownership verification and decision handling.
t3.json	Reorders script fields without behavioral changes.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

The broad Go dependency upgrades are undocumented and not covered by the stated testing or risk assessment.

1 open finding

• Unreviewed runtime dependency and transitive module upgrades · New

🧠 Review effort: Balanced

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

🔵 Needs a closer look

The PR description omits the runtime dependency refresh and compatibility pin, preventing an accurate risk assessment.

0 open findings

1 resolved since last review

• Unreviewed runtime dependency and transitive module upgrades

🧠 Review effort: Balanced