The trailer check skips a commit by its author, not by whether it is a merge

[jerome-queck]

What happened

Four Dependabot pull requests went red on conformance / check after gh pr update-branch, on a
commit nobody wrote by hand:

FAIL  006cc53  no Assisted-by: trailer as its final lines
skip  78502ea  dependabot[bot] is a bot — its commits are generated and cannot carry a trailer

006cc53 is the merge commit update-branch writes — two parents, message
Merge branch 'main' into dependabot/..., authored by whoever pressed the button.

Why it is worth recording rather than working around

CONTRIBUTING.md says, of the commits GitHub writes:

the Merge branch 'main' into … commit that the Update branch button writes when your branch
has fallen behind. The check skips a merge commit and is never run over main, so neither is
yours to get right

On this evidence the check does not skip a merge commit. It skips a commit whose author is a
bot — the skip line above says so in its own words — and an Update branch merge is authored by
the person who pressed it, so it is judged as theirs and fails for a trailer it structurally
cannot carry.

The cost is not theoretical: Dependabot then refuses to rebase the branch, because it has been
"edited by someone other than Dependabot", and the way back is @dependabot recreate on every
affected pull request.

Whose to fix

The check is ../dot-github/conformance/check-trailers.sh — the Organisation's, arriving written,
and not this repository's to own (CODING_STANDARDS.md §5). So this issue is a report, and the
decision is which of the two is wrong:

• the check, if the intent is what CONTRIBUTING.md describes, in which case it should skip
  any commit with two parents; or
• the wording, if skipping by author is the intent, in which case CONTRIBUTING.md and
  AGENTS.md describe behaviour the check has never had.

Either way both encodings should say the same thing, which is the argument those files already make
about the two encodings of the auto-merge conditions.

Acceptance criteria

• Which of the two is wrong is decided, and the fix is raised in the repository that owns it.
• CONTRIBUTING.md and AGENTS.md here describe what the check actually does.
• The warning against update-branch in docs/agents/dependencies.md is removed or kept on purpose, depending on which way it went.

Assisted-by: Claude Opus 5
Co-authored-by: Claude Opus 5 noreply@anthropic.com