fix(ci): js-autofix pushes via PR instead of direct push to main

[ethernet8023]

What does this PR do?

The js-autofix workflow's apply-patch job pushes directly to main with
git push --force-with-lease origin HEAD:main. Main now has repository rules
requiring pull requests + required status checks ("All required checks pass"),
so the push is rejected with GH013 every time eslint --fix produces changes
— the workflow is permanently broken.

This switches apply-patch to push to a dedicated bot/js-autofix branch,
create or update a PR, and enable auto-merge (squash). The repo already
has allow_auto_merge=true + delete_branch_on_merge=true, so the PR merges
automatically once status checks pass and the branch is cleaned up.

If the PR's CI fails or main moves while the PR is open, the job auto-closes
the PR and deletes the branch — the next workflow run re-applies on the current
state. This keeps the bot branch from accumulating stale PRs.

The two-job security split is preserved:

• generate-patch stays unprivileged (contents: read only) — it runs npm/eslint
  on an ephemeral runner with zero push permissions.
• apply-patch (contents: write + pull-requests: write) still never runs npm,
  never installs anything, never executes repo code — it applies the trusted patch
  artifact and delivers it via PR instead of a direct push.

Also includes a companion fix: .prettierignore now excludes package-lock.json
so npm run fix doesn't reformat the lockfile (which would produce massive
noisy diffs).

Related Issue

Fixes the failing auto-fix lint issues & formatting run:
https://github.com/NousResearch/hermes-agent/actions/runs/29447393854/job/87461501477

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)

Changes Made

• .github/workflows/js-autofix.yml: apply-patch job now pushes to bot/js-autofix
  branch + creates/updates a PR with gh pr merge --auto --squash instead of
  git push --force-with-lease origin HEAD:main
• Added pull-requests: write permission to apply-patch (needed for PR creation
  • auto-merge)
• Added a polling step that waits for merge, auto-closes the PR + deletes the branch
  if CI fails, conflicts, or main moves
• Updated workflow header comments to reflect the PR-based delivery model
• .prettierignore: exclude package-lock.json from formatting
• eslint.config.shared.mjs: exclude package-lock.json from eslint

How to Test

1. Merge this PR.
2. Push a JS/TS file with a fixable lint issue to main (e.g. unsorted imports).
3. The auto-fix lint issues & formatting workflow should:
   • generate-patch: produce a non-empty patch artifact (unchanged behavior)
   • apply-patch: push to bot/js-autofix, open a PR, enable auto-merge
4. The PR should auto-merge once status checks pass, then the branch is deleted.
5. If CI fails on the PR, it should be auto-closed + branch deleted.

The failing run's error for reference:

remote: error: GH013: Repository rule violations found for refs/heads/main.
remote: - Changes must be made through a pull request.
remote: - Required status check "All required checks pass" is expected.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass — N/A: CI workflow change, no Python tests affected
• I've added tests for my changes — N/A: GitHub Actions workflow, validated via YAML parse + structure check
• I've tested on my platform: NixOS (workflow YAML validated with yaml.safe_load)

Documentation & Housekeeping

• I've updated relevant documentation — workflow header comments updated to reflect PR-based delivery
• I've updated cli-config.yaml.example if I added/changed config keys — N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — N/A (workflow internal, no dev-facing change)
• I've considered cross-platform impact — N/A (GitHub Actions only)
• I've updated tool descriptions/schemas if I changed tool behavior — N/A

Screenshots / Logs

Failing run (current main):

remote: error: GH013: Repository rule violations found for refs/heads/main.
remote: - Changes must be made through a pull request.
! [remote rejected] HEAD -> main (push declined due to repository rule violations)
##[error]main moved since checkout. Push rejected.

[github-actions]

✅ CI-sensitive file review passed

The ci-reviewed label is present on this PR.