[xiang17]

Remove pull_request_target from the Dependabot helper while preserving
automatic dependency lockfile and license updates.

• Generate a text patch in a read-only pull_request workflow, without
  App credentials.
• Publish the patch through a separate workflow_run workflow that
  validates the source run, open Dependabot PR, and current head SHA.
• Apply changes in an isolated Git index without checking out or executing
  PR code in the privileged workflow.
• Restrict changes to regular, nonexecutable lock/license files; reject
  binary patches and patches larger than 8 MiB.
• Push using the existing GitHub App token so normal PR CI still runs.
  Do not force-push.
• Skip uploading and publishing when no generated changes are needed.
  Cancel superseded producer runs for the same PR.