Constrain kernel update checks to 6.18.x and auto-close stale dependency update PRs

[Copilot]

Dependency automation was proposing Linux v7 updates even though thinRoot is currently pinned to 6.18.x, and package update PRs could accumulate in parallel for the same component. This change scopes kernel discovery to 6.18.x and makes the workflow close older same-package update PRs when a newer one is proposed.

• Kernel updater scope (6.18.x only)

  • scripts/update-kernel-upstream.sh now resolves candidates using linux-6.18.* from kernel.org checksums instead of selecting latest-series kernels.

• Dependency PR lifecycle cleanup

  • .github/workflows/dependency-updates.yml now enumerates open PRs (with pagination), identifies stale PRs for the same update slug, and closes them before opening the new suggestion PR.
  • Keeps duplicate-title protection: if the exact target PR already exists, creation is skipped and stale closing is not triggered for that run.

• Workflow robustness

  • Introduces shared branch prefix config (BRANCH_PREFIX) so stale-PR matching and PR creation stay aligned.
  • Uses explicit JSON content type on PR close API calls.

# kernel updater now filters to supported line only
ID=${1:-$(echo "${CHECKSUM_CONTENT}" \
  | grep -oE "linux-6.18\\.[0-9]+\\.tar\\.xz" \
  | sed -E 's/^linux-//; s/\\.tar\\.xz$//' \
  | sort -V | tail -n1)}