chore: auto-merge timestamp-only contract-monitor refreshes

[CodeSigils]

Project

• Repository or specification: .github/workflows/ci.yml (maintenance/CI)
• Proposed category: CI automation

Why it belongs

The contract-monitor job in ci.yml opens weekly "auto-fix URL drift" PRs for evidence refresh in docs/evidence-urls.json. Two problems surfaced during review:

1. main requires verified commit signatures (required_signatures: true on classic branch protection — verified via the protection API; the gh api .../rulesets endpoint returns no rulesets). The interim timestamp-only "direct commit to main" step fails on every run with GH006: Protected branch update failed ... Commits must have verified signatures, leaving the weekly 06:00 cron broken since PR chore: split contract-monitor auto-fix by drift class #106 merged.
2. Bot PRs hung open (e.g. chore: auto-fix URL drift detected by contract monitor #105, open since 2026-09-21 with no CI/checks attached and no auto-merge) — the loop recurs every Monday and each instance needs a manual squash merge.

This change restores the merge path the way GitHub's signature rule accepts it:

• Timestamp-only refreshes (canonical_url_fix_count == '0'): the peter-evans PR (commits signed via sign-commits: true, exactly the pattern already proven by the merged chore: auto-fix URL drift detected by contract monitor #102) is auto-merged the same week with gh pr merge --auto --squash --delete-branch — the GitHub-signed squash merge satisfies the signature rule, and allow_auto_merge is already enabled. No human needed for routine evidence maintenance; recursion eliminated.
• Canonical URL corrections (canonical_url_fix_count != '0'): the PR stays open for human review and is labeled needs:semantic-review, matching the body text's own requirement.

Quality evidence

• yaml.safe_load passes on the edited workflow.
• Uses the verify script's existing outputs verbatim (canonical_url_fix_count, timestamp_refresh_count, pull-request-number); no script changes, no behaviour change to --check-expiry (issues) or cron-health.
• dependabot-auto-merge.yml and release.yml untouched.
• Main protection reconfirmed: classic branch protection required_signatures: true, no rulesets, no required status checks, no required reviews.

Checklist

• Single project per PR
• Read CRITERIA.md / CONTRIBUTING.md for this repo
• Entry/format conventions respected (CI file, not a list entry)
• No alphabetical-ordering concerns (not a list entry)
• Description uses checkable facts, not marketing language
• Not a tutorial/sample and not a commercial product
• No advisory signals changed (no baseline/exception files touched)
• Did not edit .github/advisory-baseline.json or .github/repo-exceptions.json
• Ran local validation (yaml.safe_load) — CI will run the full battery
• One focused change, lowest-risk path for the broken cron job