ci: auto-merge clean Dependabot PRs on plugin repos in update-plugins cron (#7493)

The daily update-plugins workflow already syncs boilerplate (workflows,
dependabot.yml, etc.) into every ether/ep_* repo via checkPlugin, but it
never closes the loop on the Dependabot PRs that config produces. With
plugin repos having no per-repo auto-merge wiring, those PRs sit green
indefinitely (e.g. ether/ep_loading_message#77).

Add a final step that, after the per-plugin updates run, walks every
ep_* repo and squash-merges any open Dependabot PR whose mergeStateStatus
is CLEAN — i.e. no conflicts, branch up to date, all required checks
green. Anything else (DIRTY, BLOCKED, BEHIND, UNSTABLE, …) is left alone
for a human.

No semver gating: trust each plugin's own CI to fail on a breaking
major bump rather than pre-filtering by version delta.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.github/workflows/update-plugins.yml

@@ -77,3 +77,34 @@ jobs:
           echo "Succeeded:$(echo $succeeded | wc -w) -$succeeded"
           echo "Failed:$(echo $failed | wc -w) -$failed"
           echo "Skipped:$(echo $skipped | wc -w) -$skipped"
+
+      - name: Merge clean Dependabot PRs on plugin repos
+        env:
+          GH_TOKEN: ${{ secrets.PLUGINS_PAT }}
+        run: |
+          # For every ep_* repo under ether, merge any Dependabot PR whose
+          # mergeStateStatus is CLEAN (no conflicts, branch up to date, all
+          # required checks green). Anything else is left alone for a human.
+          plugins=$(gh repo list ether --limit 200 --json name --jq '.[] | select(.name | startswith("ep_")) | .name')
+
+          merged=""
+          for plugin in $plugins; do
+            repo="ether/${plugin}"
+            prs=$(gh pr list --repo "$repo" \
+              --author "app/dependabot" \
+              --state open \
+              --json number,mergeStateStatus,title \
+              --jq '.[] | select(.mergeStateStatus=="CLEAN") | .number') || continue
+
+            for pr in $prs; do
+              echo "Merging ${repo}#${pr}"
+              if gh pr merge --repo "$repo" --squash --delete-branch "$pr"; then
+                merged="$merged ${repo}#${pr}"
+              else
+                echo "WARN: failed to merge ${repo}#${pr}"
+              fi
+            done
+          done
+
+          echo ""
+          echo "Merged Dependabot PRs:$merged"