deps-update: gate auto-merge on code-owner label #236

Follow-up from PR #225 review (F-SEC-006).

Current behaviour

.github/workflows/deps-update.yml runs gh pr merge --auto --squash on the bulk npm+NuGet PR (and Renovate opens its own per-package PRs with auto-merge for GH Actions + Dockerfile bases). A green CI run then merges the PR without a human review — the CI matrix is the only line of defence against a supply-chain attack that gets through the 7-day quarantine.

Proposed gate

Require a deps-approved label from a maintainer before auto-merge fires. Implementation options:

• rewrite the workflow's merge step to gate on gh pr view … --json labels --jq '.labels[].name' including deps-approved, or
• flip auto-merge on but require a deps-approved branch-protection required-review label, or
• lean on GitHub's require conversation resolution / code-owner review requirements on the paths the deps PR touches.

Acceptance

• The bulk npm+NuGet PR merges only after a code-owner explicitly signs off.
• Renovate's per-package PRs follow the same rule.
• The 7-day quarantine + human review shipping in series (rather than a single defence) is documented in docs/development/deps-update.md.

Filed as a follow-up so PR #225 can merge without expanding governance scope.