chore(skills): add deps triage skill

[mortik]

Adds a /deps skill that works through the open Dependabot queue instead of merging PRs one by one by hand. Companion to the same skill in fleetyards/fleetyards, tailored to this repo.

It classifies each bump, then applies four gates before merging: bump class (patch/minor may merge, majors go to a human), CI green, no intentional pin undone, and mergeable state. Safe PRs are squash-merged — which enqueues, given the merge queue — and everything else lands in a report with a one-line reason.

What is specific to this repo:

• Label names use the Dependabot defaults. There is no labels: block in .github/dependabot.yml, so bumps are labelled javascript / github_actions with an underscore, not the hyphenated github-actions used in the main fleetyards repo.
• The 0.x rule matters. wxt is on 0.20.x, so a 0.20 → 0.21 bump is a breaking-class change in the build tool this extension is built with, not a minor.
• Auto-merge is disabled here, so --auto is unavailable and PRs can only be merged once checks are genuinely green.
• main is protected by a ruleset, not classic protection — required checks are Type Check & Test, Build (chrome) and Build (firefox), plus a merge queue. The classic branches/main/protection API returns 404 on ruleset-protected branches, which reads as "unprotected" if you do not know to look at /rulesets.

The skill also documents the TypeScript 7 situation. #140 (typescript 6.0.3 → 7.0.2) fails Type Check & Test because TS7 moved the compiler into a native binary and reduced the typescript main export to a version string, so vue-tsc cannot run on it. reckoning/reckoning already encodes this as a permanent ignore block in its dependabot.yml; this repo does not, so the PR is reopened every week. The skill flags it and names the fix, but deliberately does not edit dependabot.yml on its own.

Docs only — no runtime code changes. 🤖

[greptile-apps]

Greptile Summary

Adds a repository-specific dependency-triage skill that classifies Dependabot updates and gates automated squash merges.

• Documents bump classification, including conservative handling of 0.x and major updates.
• Requires green CI, checks for intentional pins and known incompatibilities, and handles mergeability states.
• Defines merge-queue operation, reporting, and error-handling procedures.

Confidence Score: 4/5

The title parsing gap should be fixed before merging because it leaves an existing Dependabot PR format without a reliable bump classification.

The new workflow makes merge eligibility depend on old and new versions parsed from the PR title, although this repository has Dependabot titles that place those versions only in the PR body and the skill defines neither a fallback nor fail-closed behavior.

Files Needing Attention: .claude/skills/deps/SKILL.md

Important Files Changed

Filename	Overview
.claude/skills/deps/SKILL.md	Adds the complete /deps workflow, but its title-only version parser does not handle a Dependabot title format already used in this repository.

_{Reviews (1): Last reviewed commit: "chore(skills): add deps triage skill" | Re-trigger Greptile}

[greptile-apps]

Title-only bump classification breaks

When a Dependabot title omits from <old> to <new>, as this repository's browser-actions/release-firefox-addon bump did, this step cannot determine the bump class and defines no fallback or fail-closed behavior, causing queue processing to stop or the update to be handled without establishing that it is safe to merge.