[codex] Guard Dependabot auto-merge head SHA

[Pigbibi]

Summary

• fetch the open Dependabot PR headRefOid when resolving the workflow-run branch
• skip auto-merge if the current PR head does not match the completed CI run head
• pass --match-head-commit to gh pr merge to prevent merging an untested updated head

Root cause

The Dependabot auto-merge workflow was triggered by a successful workflow_run, but the merge command did not bind the merge to the exact commit that passed CI. If Dependabot pushed a newer commit between CI completion and the merge step, the workflow could merge a head that was not the one just checked.

Validation

• actionlint .github/workflows/dependabot_auto_merge.yml
• git diff --check