Batch dependency bumps

Collapse N dependency-bump PRs into one PR whose lockfile is resolved once, in the environment production builds with. Each bot PR resolves its lock in isolation against a stale base, so merging them one at a time produces N conflicting locks; regenerating once produces the tree that will actually ship.

Never close or comment on any PR until the replacement branch exists, builds, and is pushed.

Read the incoming PRs

1. Take PR numbers or URLs from the request. If the user asked for a whole backlog instead, list candidates (gh pr list --author app/dependabot --json number,title,files) and confirm the set with them before touching anything.
2. For each PR record: package, from-version, to-version, and which files it touches.
3. Classify each bump by whether the PR changes the manifest:
   • Direct — the PR edits package.json (or pyproject.toml, go.mod, Cargo.toml). Read the exact replacement string from gh pr diff <n>; do not reconstruct the range specifier yourself.
   • Transitive — the PR touches the lockfile only. The package sits under another dependency's range. Confirm this by finding who depends on it in the lockfile, and name that parent in the write-up.
4. Note which ecosystem and which lockfile each PR belongs to. Split the work per lockfile; one rollup branch may still carry several, but each lockfile is regenerated by its own tool.

Prepare the branch