ci: skip the per-PR OTA job for bot authors

Dependabot pushes in-repo branches, so its PRs pass the fork guard and the
per-PR OTA job runs — but GitHub withholds repo secrets from Dependabot-
triggered runs, so EXPO_TOKEN is empty and the job fails at "Setup Expo
project". Result: a red check on every dependabot PR (fails closed, nothing
reaches AWS, but it's noise on an unrelated PR).

Exclude bot authors via user.type. This keeps the fork guard as the trust
boundary and does not reintroduce the author_association check, which
wrongly skipped private org members' PRs.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/pull-request-commit.yml

@@ -234,12 +234,19 @@ jobs:
   # This matches the fork-guard gate the other jobs in this workflow use;
   # author_association is deliberately NOT checked (it can't identify a private
   # org member and would skip their PRs).
+  #
+  # Bot authors are excluded: Dependabot pushes in-repo branches, so it passes
+  # the fork guard, but GitHub withholds repo secrets from Dependabot-triggered
+  # runs. EXPO_TOKEN is then empty and the job fails at setup — a red check on
+  # every dependabot PR. There is no OTA preview worth publishing for a
+  # dependency bump anyway.
   publish-pr-ota:
     name: Publish PR OTA to denis
     runs-on: ubuntu-latest
     if: >-
       github.event_name == 'pull_request' &&
-      github.event.pull_request.head.repo.full_name == github.repository
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.user.type != 'Bot'
     concurrency:
       group: pr-ota-${{ github.event.pull_request.number }}
       cancel-in-progress: true