ci: run verify for dependabot branches

[sitepark-veltrup]

Dependabot PRs never got a verify run: push ignored dependabot/** and pull_request ignores PRs against main, so the required verify / Composer Verify checks were never reported and the PRs stayed blocked.

• run verify on push for every branch (incl. dependabot)
• add the shared dependabot auto-merge workflow for minor/patch updates

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (376e9d1) to head (ff0364d).

Additional details and impacted files

@@             Coverage Diff             @@
##                main        #7   +/-   ##
===========================================
  Coverage     100.00%   100.00%           
  Complexity         2         2           
===========================================
  Files              1         1           
  Lines              4         4           
===========================================
  Hits               4         4           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.