fix: harden Dependabot automation

[Pigbibi]

Summary

• use GitHub native auto-merge so eligible dependency PRs wait for every required check
• keep major, Docker, GitHub Actions, and internal QuantStrategyLab updates manual
• preserve the exact Dependabot PR head-SHA guard
• narrow CODEOWNERS to risk and broker-sensitive source paths
• disable the reactive review-request cleanup trigger while retaining a static-gate-compatible tombstone

Root cause

The merge workflow ran before other required checks completed. Separately, review-request cleanup ran only after GitHub had already sent the notification.

Validation

• actionlint
• semantic merge-policy cases: routine minor, major, Docker, GitHub Actions, internal dependency
• git diff --check

No business logic, deployment, runtime, broker, order, or capital behavior is changed.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:66600c9b79

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:ca729add37

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Cover remaining shared execution modules

The fresh evidence in this revision is that the expanded allowlist still stops after four shared files, while a repo-wide search shows other unowned order-critical modules: common/ports.py:23 defines the core submit_order port, common/execution_state.py:164 detects prior executions, and common/order_status.py:130 normalizes execution reports. When a PR changes any of these modules, GitHub will request no code-owner review and cannot require code-owner approval, despite the stated order-sensitive scope; add ownership patterns for the remaining shared execution paths.

Useful? React with 👍 / 👎.