reviewing-dependabot-prslisted

# reviewing-dependabot-prs Dependabot PR events don't receive this repo's secrets (GitHub withholds them from bot-triggered `pull_request` runs), which is why `claude-pr-review.yml` already excludes `dependabot[bot]` from the mandatory review gate — Dependabot PRs only clear `verify`, `dependency-review`, and CodeQL today, with no review step and no merge/hold/reject decision at all. This skill fills that gap by running as **you**, through your own `gh` auth and Claude access, so it needs no workflow secret and no new CI wiring. ## Boundary rules - Never execute a merge, comment, or close for any PR until you've shown the full batch of proposed verdicts for **every** open Dependabot PR in this run and gotten one explicit confirmation covering the batch. Never ask per-PR — that defeats the point of automating a backlog sweep. - Never enable the repo's Settings → General → "Allow auto-merge" toggle yourself — that's a repository setting, not a PR action, and stays a human call. If `gh pr merge --auto` fails because it's off, report that as a prerequisite the user needs to flip and stop; don't work around it. - Never post `@dependabot ignore` or otherwise permanently suppress a dependency. REJECT is always a plain close + rationale comment. Be exact about what that buys: on a **grouped** PR, Dependabot's own body says "This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests." That is a pro