chore: merge timestamp-only contract-monitor PR directly

[CodeSigils]

Project

docs/MAINTENANCE.md-style maintenance note: this change is limited to .github/workflows/ci.yml (the monitor-external-contracts job). No list entry, no criteria change.

Why it belongs

The contract-monitor timestamp-only path used gh pr merge --auto --squash --delete-branch, but this repository's main branch has zero required status checks (branch protection: required_signatures: true, no required_status_checks, no rulesets). A bot PR is therefore immediately mergeable ("clean status"), and GitHub declines enabling auto-merge with:

GraphQL: Pull request is in clean status (enablePullRequestAutoMerge)

This was observed live on the re-dispatched monitor run (workflow run 35856108706 failed at the auto-merge step). The direct merge path was verified instead: PR #108 (the same timestamp-only refresh, created by the monitor) merged successfully via gh pr merge --squash --delete-branch (merge commit 81e4e4a); GitHub signs the squash-merge commit, which satisfies required_signatures: true.

Quality evidence

• yaml.safe_load passes on the edited workflow file.
• No script changes — verify-marketplace-urls.py outputs (canonical_url_fix_count, timestamp_refresh_count) are used verbatim.
• Behavior empirically verified: PR chore: auto-fix URL drift detected by contract monitor #108 merged directly (81e4e4a, 2026-09-23T11:47:12Z); --auto declined on the same PR class.
• dependabot-auto-merge.yml and release.yml untouched.
• Canonical-URL corrections still open a review PR labeled needs:semantic-review (unchanged).

Checklist

• Single logical change in one PR
• Read CRITERIA.md and contributing.md (no criteria impact — CI maintenance)
• Entry format N/A (no list entry added/removed)
• No alphabetical ordering impact
• Description is factual and independently verifiable
• Not a tutorial, sample, or commercial product
• No advisory-baseline or exception changes
• Does not edit .github/advisory-baseline.json or .github/repo-exceptions.json
• Local checks pass (yaml validation)
• Verified the exact failure mode before changing code