Prefix dedupe commit message + set GH_TOKEN for push step

- Commit subject prefixed with "[github-actions]" so the audit trail
  is obvious at a glance in `git log`.
- GH_TOKEN exposed as an env var on the commit step so the PAT is
  also available to any `gh` invocations the step might grow, and the
  token plumbing is visible at the site where the push happens — not
  only up at the checkout step.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/workflows/dependabot-dedupe.yml

@@ -59,12 +59,14 @@ jobs:
       - run: pnpm install --frozen-lockfile=false
       - run: pnpm dedupe
       - name: Commit dedupe changes
+        env:
+          GH_TOKEN: ${{ secrets.DEPENDABOT_DEDUPE_TOKEN }}
         run: |
           if [ -n "$(git status --porcelain pnpm-lock.yaml)" ]; then
             git config user.name "dependabot[bot]"
             git config user.email "49699333+dependabot[bot]@users.noreply.github.com"
             git add pnpm-lock.yaml
-            git commit -m "pnpm dedupe"
+            git commit -m "[github-actions] pnpm dedupe"
             git push
             echo "Deduped lockfile pushed."
           else