fix: auto-merge only waited on Code Quality, never retried after Security

auto-merge.yml only listened for the "Code Quality" workflow_run event.
Whenever "Security" (CodeQL etc., usually the slower of the two) finished
after Code Quality, the merge attempt fired too early, failed against the
still-pending required check, and nothing ever re-triggered it - the PR sat
open until someone noticed and merged it by hand. This is the actual cause
behind the recurring "master->main sync PR stuck" issue, not a one-off fluke.

Now listens for both workflows, and verifies every required check is
actually green (via `gh pr checks --required`) before merging rather than
trusting that the one workflow which fired us means everything is done -
whichever of the two finishes last will now successfully trigger the merge.

.github/workflows/auto-merge.yml

@@ -2,7 +2,12 @@ name: Auto Merge
 
 on:
   workflow_run:
-    workflows: ["Code Quality"]
+    # Both required workflows must be listed - this used to list only "Code Quality", so whenever "Security"
+    # (which includes CodeQL, usually the slower one) finished AFTER Code Quality, nothing ever re-triggered
+    # the merge attempt and the PR sat open until someone noticed and merged it manually. Listing both means
+    # whichever finishes LAST fires this workflow, and the check-verification step below (not just "trust the
+    # one workflow that happened to trigger us") confirms every required check is actually green before merging.
+    workflows: ["Code Quality", "Security"]
     types: [completed]
 
 jobs:
@@ -41,6 +46,15 @@ jobs:
             exit 0
           fi
 
+          # Don't trust that the workflow which triggered us means every required check is done - the other
+          # workflow (Code Quality vs Security) might still be running. Verify every required check is
+          # actually green before attempting to merge; if not, exit quietly and let whichever check finishes
+          # last re-trigger this workflow.
+          if ! gh pr checks "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" --required --watch=false; then
+            echo "Not all required checks are green yet for PR #$PR_NUMBER - skipping, will retry when the remaining workflow completes"
+            exit 0
+          fi
+
           echo "Merging PR #$PR_NUMBER"
           gh pr merge "$PR_NUMBER" \
             --repo "$GITHUB_REPOSITORY" \