[codex] Fix IBIT zscore workflow and Dependabot guard

[Pigbibi]

Summary

• export ZSCORE_METRICS_URLS inside the IBIT zscore publish target step before the same-step Python host summary reads it
• add a stale-run guard to the Dependabot auto-merge workflow by comparing the PR headRefOid with github.event.workflow_run.head_sha
• pass --match-head-commit to gh pr merge so only the CI-checked Dependabot head can be merged

Root cause

The failed Publish Strategy Plugins run wrote ZSCORE_METRICS_URLS to $GITHUB_ENV and then tried to read it from Python in the same step. $GITHUB_ENV only affects subsequent steps, so the Python process raised KeyError: 'ZSCORE_METRICS_URLS'.

The Codex review on the Dependabot maintenance PR also identified that auto-merge could merge a newer untested Dependabot head if the branch changed after the CI run completed.

Validation

• actionlint .github/workflows/publish-strategy-plugins.yml .github/workflows/dependabot_auto_merge.yml
• git diff --check
• local shell simulation of the IBIT zscore resolve block with the default metrics URL

Notes

• Existing untracked local uv.lock was intentionally left out of this PR.