agents: add composite action dependabot, secret PR, and merge queue rules (#4307)

Composite actions under .github/actions/ can be missed by Dependabot and
secret-gated workflow steps do not run on fork PRs. Also, gh pr merge
rejects --delete-branch when a merge queue is enabled. Update workflow
and merge guidance so agents keep composite actions updated, test
secret-gated changes from upstream branches, and omit --delete-branch
when merging.

.agents/rules/github_actions_workflows.md

diff --git a/.agents/rules/github_actions_workflows.md b/.agents/rules/github_actions_workflows.md
index dfec2b0..f4c2892 100644
--- a/.agents/rules/github_actions_workflows.md
+++ b/.agents/rules/github_actions_workflows.md
@@ -1,12 +1,23 @@
 ---
 name: github-actions-workflows
 trigger: glob
-globs: ".github/workflows/**,.github/actions/**"
+globs: ".github/workflows/**,.github/actions/**,.github/dependabot.yml"
 ---
 
 # GitHub Actions Workflows Rule
 
-* Use the latest version of referenced actions in `.github/workflows/`.
+* Use the latest version of referenced actions in `.github/workflows/` and
+  `.github/actions/` (ensuring actions target supported Node.js runtimes such as
+  `node24` rather than deprecated `node20`).
+* **Dependabot Coverage for Composite Actions**: When adding a composite action
+  directory under `.github/actions/<name>`, add `"/.github/actions/<name>"` to
+  the `github-actions` `directories` list in `.github/dependabot.yml` (since
+  `directory: "/"` only scans `.github/workflows/`).
+* **Verifying Secret-Gated Workflow Steps**: GitHub Actions does not expose
+  repository secrets (e.g. `secrets.BUILDBUDDY_CAS_ONLY_KEY`) to `pull_request`
+  runs from forks (`origin`). To test secret-gated workflow or composite action
+  steps in CI, push the branch to `upstream` and open the PR from
+  `bazel-contrib:<branch>`.
 * **Use Local Composite Actions (`./.github/actions/setup-bazel`)**: Always use
   local composite action wrappers (such as
   `uses: ./.github/actions/setup-bazel`) instead of invoking upstream actions

.agents/skills/merge-pr/SKILL.md

diff --git a/.agents/skills/merge-pr/SKILL.md b/.agents/skills/merge-pr/SKILL.md
index f05a760..f410692 100644
--- a/.agents/skills/merge-pr/SKILL.md
+++ b/.agents/skills/merge-pr/SKILL.md
@@ -15,6 +15,8 @@
      "merge immediately" once CI passes and only `REVIEW_REQUIRED` blocks).
      Never pass `--admin` while CI is pending or failing unless told to bypass
      CI.
+   - **No `--delete-branch` (`-d`)**: Never pass `-d` or `--delete-branch` to
+     `gh pr merge`; it fails when a merge queue is enabled on the repository.
 2. **Invoke a Background Shepherd**: Launch a background subagent with the role
    `Merge PR Shepherd` to continuously watch the PR until it merges.
 3. **Leverage Existing CI Skills**:

.agents/skills/review-code/review-workflows-prompt.md

diff --git a/.agents/skills/review-code/review-workflows-prompt.md b/.agents/skills/review-code/review-workflows-prompt.md
index 4543704..c0ef0d0 100644
--- a/.agents/skills/review-code/review-workflows-prompt.md
+++ b/.agents/skills/review-code/review-workflows-prompt.md
@@ -8,7 +8,10 @@
 2. Verify executable permissions: any script invoked directly as a workflow
    step (e.g. `.github/workflows/*.py`, `*.sh`) must have `chmod +x` (filemode
    `100755`) and an appropriate shebang (e.g. `#!/usr/bin/env python3`).
-3. Verify action versions: ensure workflow steps use the latest action versions.
+3. Verify action versions and Dependabot coverage: ensure steps in
+   `.github/workflows/**` and `.github/actions/**` use the latest action
+   versions, and verify every `.github/actions/<name>` directory is listed under
+   `github-actions` `directories` in `.github/dependabot.yml`.
 4. Verify fallback jobs: ensure `suppress-no-jobs-ran-error` / `noop` fallback
    jobs exist in conditional workflows.
 5. Check event payload handling: for steps that are a single Python script,