[aj1126]

Summary

• Auto-Add PR to Project (.github/workflows/pr-opened.yml) fails on every Dependabot PR (e.g. run 37139271264): Dependabot-triggered runs get no Actions secrets, so PROJECT_PAT is empty. The repo has no Dependabot secrets.
• Fix: job condition if: github.event.pull_request.user.login != 'dependabot[bot]'. It checks the PR author, not github.actor, so a human re-opening a bot PR still skips.
• Plan: ~/.claude/plans/ci-failures-2026-10.md §1 F11, §3 L6, §4 S5. Verified when the next Dependabot PR shows this job skipped, not failed.

Checks run on d4997f57, 2026-10-08:

• The workflow parses (yaml.safe_load; control: a malformed snippet raised).
• gitleaks git --log-opts=origin/main..HEAD (8.30.1) → no leaks (control: planted AWS key + GitHub token → 2 findings, exit 1).
• git merge-tree against origin/main: clean, 1 commit, 0 behind. Commit signed G.

Checklist

• I reviewed whether this change affects README, architecture docs, or legacy docs: it doesn't (workflow condition only).
• If commands, supported file types, or layout metadata changed, I ran npm run docs:generate: none changed, so not needed.
• I ran npm run docs:check: ran, exit 1 ("Autogenerated documentation sections are stale"). The same failure on origin/main 29a77664 (control run), so it predates this PR, which touches no docs.
• If historical Python prototype guidance changed, I updated docs/legacy-prototype.md: it didn't change.