Digest: report Dependabot security updates off, and Dependabot PRs that did not merge #228

Part of the "apply every Dependabot update immediately" rollout (Andrew, 2026-10-25). After that change no human approves Dependabot PRs, so the digest is the only place that shows when the automatic path fails.

1. Dependabot security updates: on or off

scripts/dependabot-digest/standards.sh reads repos/{o}/{r}/vulnerability-alerts (dev-env#220). Alerts on does not mean security-update PRs open. STATUS.md (2026-10-21): on 7 NOS repos and vpn-lan-bridge, "Security updates were left off."

• Read GET repos/{o}/{r}/automated-security-fixes (enabled, paused).
• Report on / off / paused / unreadable, with the same strictness as feat(digest): survey Dependabot security alerts in the daily digest #220 (only an exact, known "off" answer counts as off).
• Forks stay exempt (feat(digest): exempt forks from the Dependabot alerts section #221).
• Check that the digest App installation has the permission this endpoint needs; record it in docs/runbooks/dependabot-digest-credentials.md if a scope change is necessary.

2. Dependabot PRs that did not merge

The digest buckets open Dependabot PRs by what a human must do. After github-workflows#203, every open Dependabot PR older than a few hours is a failure of the automatic path.

• New top bucket: open Dependabot PR older than N hours (proposal: 6), or carrying the dependabot-blocked label that docs: record the 2026-10-08 work in STATUS #203 adds. Show the reason: red check (own or borrowed from a red default branch, per the Dependency upgrades have no release valve: majors and grouped PRs wait on review that does not scale #120 analysis), gate deadline, auto-merge not enabled on the repo, approval refused (can_approve_pull_request_reviews off).
• Push an ntfy alert for this bucket, the same way scripts/site-monitor/ does. A daily issue that nobody reads is the failure mode Dependency upgrades have no release valve: majors and grouped PRs wait on review that does not scale #120 describes.
• The paste-ready merge-lock lines stay for local use, but they are no longer the main path.

3. Run cadence

The digest runs at 14:00 UTC daily. With daily Dependabot schedules and immediate security PRs, decide whether that is enough, or whether the "not merged" check runs more often (the site-monitor launchd dispatch on MIMOLETTE is an option).

Tests: bash scripts/dependabot-digest/tests/run-tests.sh, with fixtures for each new state.