fix(ci): approve checks after Dependabot lock repair

[bgard68]

Summary

• replace the incomplete manual workflow dispatch after the NuGet lock-file repair
• approve every pull_request workflow GitHub creates in action_required for the repaired commit
• preserve branch-specific CI selection for main (EF Core) and dapper without merging the branches
• remove the now-unused pull-request permission and avoid accidentally entering a deploy path

Why

GitHub creates pull_request/synchronize workflows triggered by a GITHUB_TOKEN update in an approval-required state. PRs #132 and #133 demonstrate the failure: the lock files were repaired, but all checks on the repaired commit have zero jobs and conclusion action_required. The existing fallback manually dispatches only a subset of checks, omitting checks such as dependency review and script syntax.

Validation

• git diff --check
• Bash syntax validation for the embedded approval script
• mocked GitHub API query/approval loop
• patch applicability checked against current main

No application implementation changes are included.