fix: use pull_request.user.login instead of github.actor for bot check

[adamtheturtle]

Fixes adamtheturtle/literalizer#146

The github.actor check is unreliable - it reflects who triggered the workflow, not who opened the PR. Use github.event.pull_request.user.login instead.

Flagged by zizmor bot-conditions audit.

Made with Cursor

---

Note

Low Risk
Low risk change limited to a GitHub Actions conditional and a lint configuration cleanup; main impact is whether Dependabot PRs are correctly auto-merged.

Overview
Updates the Dependabot auto-merge GitHub Action to gate execution on github.event.pull_request.user.login == 'dependabot[bot]' instead of github.actor, ensuring the check reflects the PR author rather than the workflow trigger.

Cleans up zizmor.yml by removing the bot-conditions rule disable now that the workflow no longer relies on the flagged pattern.

^{Written by Cursor Bugbot for commit 5d1d134. This will update automatically on new commits. Configure here.}