Stabilize CI for updated pull requests

[ashtree74]

Summary

• identify Dependabot PRs by the PR author instead of the workflow actor
• exclude mechanical merge commits created by GitHub branch updates from DCO scope
• continue requiring a valid Signed-off-by line on every non-merge contribution commit
• make the source synchronization test await actual selection and scroll events instead of fixed timing windows

Verification

• workflow YAML parsed successfully
• reproduced PR ci: bump actions/checkout from 6.0.2 to 7.0.1 #17 history: the unsigned GitHub merge is excluded, while the signed Dependabot contribution remains in scope
• synchronization test passed 25 consecutive runs, then another 10/10 after final review edits
• full local suite passed: 135 XCTest + 5 Swift Testing tests
• git diff --check passed

Signed-off-by: Adam Jesionkiewicz adam@jesion.pl

[ashtree74]

Self-review completed. No blocking findings.

The check still enforces DCO on every non-merge contribution commit. It only excludes merge commits generated while updating a PR branch and uses the immutable PR author to identify Dependabot. Reproduction against PR #17 leaves its signed bot commit in DCO scope and excludes only the unsigned mechanical merge.

I cannot approve my own PR; after required checks pass I will use the documented maintainer PR-only bypass.

[ashtree74]

Follow-up self-review after the CI-discovered timing failure: no blocking findings.

The test now waits for the two observable synchronization events with bounded one-second expectations and one-shot callbacks. This removes both fixed RunLoop delays from the affected test without changing production code. The final affected test passed 10/10 after review edits (35 consecutive local passes total), and the full suite passed before the one-shot callback hardening. Both commits carry DCO sign-off.