fix: use pull_request.user.login instead of github.actor for bot check

[adamtheturtle]

Fixes adamtheturtle/literalizer#146

The github.actor check is unreliable - it reflects who triggered the workflow, not who opened the PR. Use github.event.pull_request.user.login instead.

Flagged by zizmor bot-conditions audit.

Made with Cursor

---

Note

Low Risk
Low risk change confined to a GitHub Actions workflow condition and a zizmor config tweak; primary impact is whether the auto-merge job runs for Dependabot PRs.

Overview
Updates the Dependabot auto-merge workflow to gate execution on github.event.pull_request.user.login == 'dependabot[bot]' instead of github.actor, making the bot check depend on the PR author rather than the workflow trigger.

Removes the bot-conditions suppression from zizmor.yml, aligning the config with the updated workflow condition.

^{Written by Cursor Bugbot for commit 3068983. This will update automatically on new commits. Configure here.}