feat(commands): add babysit-dependabot-pr command

[dyoshikawa]

Summary

Adds a new rulesync command, babysit-dependabot-pr, that shepherds a Dependabot dependency-bump PR all the way to a clean merge.

The command captures the workflow:

1. Verify the author is the genuine Dependabot bot — via the API (login = dependabot[bot], type = Bot, id = 49699333, GitHub's canonical Dependabot app user id), not just gh pr view --json author. Stop if it is not genuine.
2. Check CI status — merge only when every check passes; never with pending/failing checks.
3. Diagnose and resolve a failing bump — read the failing run logs, spot the culprit (commonly a single major-version bump in a grouped update). Preferred resolution: exclude that one dependency (pin it back to the version on main, regenerate the lockfile surgically), let the remaining updates land, and file a separate tracking issue for the deliberate migration. Fix-forward and close-for-regeneration are documented as alternatives.
4. Merge with --admin --merge, leaving a comment recording what happened.
5. Clean up the local babysit branch and report the outcome.

PR titles, branch names, and comment bodies are treated as untrusted data.

This generalizes the manual babysit of PR #2114 (js-yaml v5 excluded from the group bump; migration tracked in #2122).

Test plan

• pnpm cicheck passes (code + content; 6752 tests green).
• The command source parses correctly via the rulesync MCP get operation (valid frontmatter + body).