ci(automerge): use AUTOMERGE_TOKEN so workflow-file PRs can merge

GITHUB_TOKEN cannot merge PRs that edit .github/workflows/* (no workflows
permission scope), which failed every github-actions dependabot PR. Switch
to a PAT/App-token secret. Also normalize timeout(10)/checkout(@v6)/permissions
across the family.

Author: eetu

.github/workflows/automerge.yaml

@@ -4,19 +4,23 @@ on:
   pull_request:
     branches: [develop]
 
+# Uses AUTOMERGE_TOKEN (a PAT/App token with contents + pull_requests + workflows)
+# instead of GITHUB_TOKEN: GITHUB_TOKEN cannot merge PRs that edit
+# .github/workflows/* (no `workflows` permission scope exists), which blocks
+# every github-actions dependabot PR.
 permissions:
   contents: write
   pull-requests: write
 
 jobs:
   automerge:
     runs-on: ubuntu-latest
-    timeout-minutes: 5
+    timeout-minutes: 10
     if: github.actor == 'dependabot[bot]'
 
     steps:
       - uses: actions/checkout@v6
       - name: Automerge Dependabot PR
         uses: eetu/action-automerge@v1
         with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
+          github_token: ${{ secrets.AUTOMERGE_TOKEN }}