ci: cut redundant Actions runs, add required-check gate job

.github/dependabot.yml

@@ -6,7 +6,7 @@ updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "weekly"
+      interval: "monthly"
     groups:
       actions:
         patterns: ["*"]

.github/workflows/ci.yml

@@ -5,10 +5,6 @@ name: CI
 # waits on before enabling auto-merge.
 
 on:
-  push:
-    branches: [main]
-    paths-ignore:
-      - "**/*.md" # the daily profile refresh only touches README.md
   pull_request:
     branches: [main]
 
@@ -50,3 +46,14 @@ jobs:
               yaml.safe_load(open(f))
               print("ok", f)
           PY
+
+  # Single stable name for the org's required-status-check ruleset to point
+  # at, regardless of how the real jobs above are split or renamed.
+  required-checks-passed:
+    name: Required checks passed
+    runs-on: ubuntu-latest
+    needs: [actionlint, scripts]
+    if: always()
+    steps:
+      - if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
+        run: exit 1

.github/workflows/dependabot-auto-merge.yml

@@ -21,5 +21,10 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
-    if: github.event.workflow_run.conclusion == 'success'
+    # Every other actor's CI completion used to match this too, spinning up
+    # the reusable workflow (and its PR lookup) just to no-op - narrowing the
+    # trigger itself to the only actor that can ever be eligible below.
+    if: >-
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.actor.login == 'dependabot[bot]'
     uses: drumandbytes/reusable-actions/.github/workflows/auto-merge.yml@v1