dependabot-shepherd — a GitHub App that makes Dependabot pull requests zero-touch: policy-checked approval, auto-merge, and rebase nudges. Webhook endpoint: /api/github/webhooks (POST only).