Give gh a repo to talk to, so the label step stops failing (#20)

The label-based sweep has never once run its write path. `automerge-eligible`
exists in no repo in the fleet, and every scheduled sweep since the design
landed reports `sweep acted on 0 PR(s)` -- because the sweep's first branch is
`if label not in names`, and the label is never applied.

appeler/pranaam#35, run 31283649110, has the whole story:

    ecosystem=uv group=security update-type=version-update:semver-minor eligible=true
    Run gh label create "$ELIGIBLE_LABEL" --force ...
    failed to run git: fatal: not a git repository
    ##[error]Process completed with exit code 1

Neither job checks out the repo; they do not need the code. Every other gh call
passes a full PR URL and resolves the repo from the argument. `gh label create`
takes no URL, so it falls back to reading a git remote, finds none, and exits 1.
Under `bash -e` that kills the step, so `gh pr edit --add-label` never runs, and
a failed step aborts the job, so the arming step never runs either.

Reproduced outside CI in an empty directory -- same error string -- and
confirmed that GH_REPO alone fixes it.

Set at workflow level rather than on the one broken step: the sweep job was
already setting it on two of its steps, so this removes that duplication and
makes the next gh call added to either job correct by default.

Fixed first in finite-sample/calibre#12; this is the same file.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: soodoku

.github/workflows/dependabot-auto-merge.yml

@@ -36,6 +36,12 @@ env:
   # loud. Silence is the failure mode this workflow exists to fix, so a sweep
   # that quietly does nothing must still leave a mark.
   STALE_AFTER_HOURS: 12
+  # Neither job checks out the repo, so gh has no git remote to infer from.
+  # Steps that pass a PR URL resolve the repo from the argument; `gh label
+  # create` takes no URL, so it fell back to git and exited 1 -- on every
+  # eligible PR the fleet ever saw. Set once here rather than per step: the
+  # next gh call added to either job is then correct by default.
+  GH_REPO: ${{ github.repository }}
 
 jobs:
   classify:
@@ -144,7 +150,6 @@ jobs:
       - name: Collect open Dependabot PRs
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GH_REPO: ${{ github.repository }}
         run: |
           gh pr list --author "app/dependabot" --state open --limit 100 \
             --json number,url,title,labels,autoMergeRequest,mergeStateStatus,statusCheckRollup,createdAt \
@@ -251,7 +256,6 @@ jobs:
       - name: Arm or land
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GH_REPO: ${{ github.repository }}
         run: |
           acted=0
           while IFS=$'\t' read -r n act _rest; do