A green CI run does not prove a transitive dependency bump is safe: the
repo's own tests never exercise how the intermediate package uses the changed
API. Approve as before, but only arm auto-merge when the diff looks routine.

Held back for a human when any of these match:
  - the bot's title declares a major version upgrade
  - a JS manifest touches resolutions/overrides (a forced transitive pin)
  - go.mod gains a +incompatible major bump
  - more than 6 manifest dependency lines change at once
  - the lockfile rewrite exceeds 600 lines

Validated against 13 real bot PRs: correctly holds xfiles#543 (docker v24->v25
+incompatible), blocks#3039 (major axios), renderer#1481 and mail-composer#400
(forced resolutions), and correctly passes the single direct minor bumps such
as embed#760, pages#620 and purgatory#314.

Also drops the checkout and 'apt-get install gh' steps: nothing read the working
tree (gh is API-only) and gh ships on ubuntu-latest. All repos now hold a
byte-identical file apart from the allowlist line.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assess risk first, then approve only when the diff looks routine. A risky PR
now gets no approval at all, so it cannot satisfy the required-review count and
a human has to sign it off - the label alone was advisory, since a bot approval
already met the review requirement.

Also close the stale-arming gap: a PR can open looking routine (approved,
auto-merge armed) and then be force-pushed into something risky. On the risky
path the workflow now calls 'gh pr merge --disable-auto' and dismisses its own
earlier approval before labelling and commenting.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>