[Jukingen]

Summary

Dependabot pull requests #119 and #120 updated frontend-sites/package.json and frontend-sites/package-lock.json without the root package-lock.json. Root npm ci then failed because the workspace manifest and the hoisted lock were out of sync.

The auto-merge job now reads gh pr diff --name-only after Dependabot metadata and before gh pr merge --auto. A patch or minor pull request that changes any package.json is auto-merged only when the root package-lock.json is in that diff. A workspace-local lockfile does not satisfy the check. When the root lock is missing, the job comments on the pull request and leaves auto-merge off. Pull requests with no package.json change (NuGet csproj bumps) are unchanged.

frontend-sites minor and patch updates for next, react, react-dom, and @types/* now share one Dependabot group so those manifests move together. That group still does not update the root lock; the guard keeps auto-merge off until it does.

Test plan

• Dry-run of the guard on chore(deps-dev): bump @types/react from 19.2.17 to 19.3.0 in /frontend-sites in the frontend-sites-minor-patch group #119 and chore(deps): bump next from 16.2.10 to 16.4.2 in /frontend-sites #120 (frontend-sites/package.json + local lock, no root lock) blocks auto-merge.
• Dry-run on chore(deps): bump the frontend-admin-minor-patch group across 1 directory with 33 updates #116, chore(deps): bump the frontend-admin-minor-patch group with 2 updates #123, and chore(deps): bump react-native-safe-area-context from 5.7.0 to 5.10.1 #127 (workspace package.json plus root package-lock.json) allows auto-merge.
• Dry-run on Bump the backend-minor-patch group with 16 updates #132 and Bump Microsoft.AspNetCore.Mvc.Testing from 10.0.10 to 10.0.13 #133 (csproj only) allows auto-merge.
• After merge, a future Sites-only Dependabot pull request stays open with the lockfile comment instead of enabling auto-merge.