feat(fleet): admit dependabot, and carry what lands back downstream

[rubenvdlinde]

The problem

Dependabot reads its config from the repository's default branch only. Ten fleet apps default to main, whose .github/dependabot.yml carries no target-branch — so every bump is opened against main, where branch-protection correctly refused it.

Measured 2026-08-30 — 41 open pull requests that could never merge:

App	PRs		App	PRs
zaakafhandelapp	12		dossiq	2
filinq	11		planninq	2
openregister	5		thematiq	1
opencatalogi	3		launchpad	1
integriq	3		stackiq	1

Dependabot reopens them, so the backlog only grew. The 11 apps whose default is already development have no backlog at all — the split falls exactly on the default branch, which is what identifies the cause.

Two changes

1. branch-protection.yml admits dependabot/* into main and beta, alongside beta, hotfix/* and release/v*. Exercised across 12 source/target pairs — the six that should pass do, and feature/* is still refused into both main and beta, so this is a narrow allowance, not a hole.

2. fleet-back-merge.yml carries whatever reaches main down into beta, and whatever reaches beta down into development.

It deliberately does not try to identify the source of each commit — squash merges, direct pushes and force-pushes all defeat that. It asks the question the refs can answer exactly: does the upstream branch hold anything the downstream one does not? If beta → main was the only route, the answer is no and nothing happens.

Dry run against the real fleet

TOTALS: opened=42 merged=0 in-sync=0 skipped=2

Every app has main ahead of beta and beta ahead of development — 1 to 75 commits per hop. That accumulated divergence is why promotions keep conflicting on version files and lockfiles. The 2 skips are humaniq, which has neither a main nor a beta branch, correctly reported rather than silently counted as in sync.

Note before merging: the first scheduled run will open ~42 back-merge PRs. That is the true size of the existing divergence, not noise the workflow creates — but it is a visible one-off. workflow_dispatch offers a dry run if you want to see it first.

Withdrawn from this PR

An earlier revision also added planninq to fleet-apps.json. That was wrong: planninq was already listed under deprecated, so adding it to swept left it in both lists. #644 makes that call properly — with the evidence that planninq ships <id>planninq</id> and released while still marked not-taken-forward — and pairs it with the correction that zaakafhandelapp is the deprecated one. Reverted here; #644 owns it.

Verification

• YAML parses; bash -n on each run block extracted from the parsed YAML (a YAML parse says nothing about the shell inside it).
• The hop logic exercised against a mocked gh across 9 cases. The two that matter most: an empty comparison and a literal null are both refused rather than read as "in sync" — gh api --jq prints null on a 404, which a numeric test would happily coerce.
• Merging is held to the same rule as fleet-friday-merge: every check reported and none failed. Pending, cancelled, unreadable and zero checks are each a refusal — a conflicted PR runs no CI at all, and "no failures" is exactly what that looks like.
• Merges use --merge, never --squash: a squash would create a commit the source branch does not contain, reopening the gap it just closed.