ci: make one-PR-per-example structural, and classify merge failures

Two fixes from the fifth review on #844.

The per-directory grouping premise was wrong, and my earlier confirmation of it
was bad evidence. #804 and #811 do show Dependabot splitting an identical update
set per directory — but those PRs were produced with no dependabot.yml at all, so
they describe ungrouped security updates, not what `directories` plus a group does.
The search API finds 307,565 pull requests titled "Bump the <group> group across N
directories with M updates", including "across 17 directories with 100 updates".
Grouping does span directories.

That breaks two things this PR asserted. The blast-radius rationale inverts: a bad
bump would block the security fixes for every example in the group rather than one.
And auto-merge would essentially never fire, because the coverage gate refuses any
pull request touching an example that example-matrix.json does not build and boot,
and a cross-directory npm or pip pull request would nearly always include one.

So the config is now one entry per example — 47 of them, plus github-actions —
each scoped with `directories: ["/examples/<name>", "/examples/<name>/**"]`. One
pull request per example app is now a property of the config rather than an
assumption about Dependabot's behavior, which is what the review asked for. The
cost is a 579-line config file; the alternative was keeping eight short entries and
an auto-merge workflow that never merges anything.

Classify merge failures instead of going red on all of them. `gh pr merge` exits
non-zero when the pull request is not mergeable, and under set -e that turned an
expected outcome into a red run — on the one workflow whose colour signals whether
the automation is healthy. The reachable case is the sibling race this PR exists to
fix: several pull requests touch one lockfile, the first merge conflicts the rest,
and GitHub has not necessarily recomputed mergeability yet. A moved head or a
non-mergeable state now exits 0 with the reason; anything unexplained still fails
loudly, so a real misconfiguration (squash merges disabled, a missing permission)
is not swallowed. Four paths exercised against a stubbed gh.

Author: bnusunny