Fix Docker dependency PR automation

[fqjony]

Summary

• keep Docker dependency releases push-driven by leaving updater auto-merge disabled
• use the existing GH_TOKEN service-account secret for generated Docker dependency PR branch writes and optional merge commands, so push-triggered Build/Release workflows are not suppressed by github.token
• make generated Docker dependency PRs request the udx/worker team and apply docker/dependencies labels
• include the checkout v7 update from PR Bump actions/checkout from 6 to 7 in /.github/workflows #141
• use peter-evans/create-pull-request@v8, matching the org preference for major Action tags instead of raw SHA pins
• remove the temporary caller-side control gate from worker; docker-ops gate hardening belongs in udx/reusable-workflows

Validation

• ruby YAML parse for docker-ops and docker-dependency-updater workflows
• git diff --check for both workflow files

Notes

This fixes the PR #140 failure mode without manually releasing. The reusable docker-ops gate fix is intentionally separate and should land in udx/reusable-workflows.

[Copilot]

Pull request overview

This PR updates the repository’s GitHub Actions automation around Docker releases and Docker dependency update PRs, aiming to prevent an unsafe manual release path while keeping dependency update PRs non–auto-merged and better triaged.

Changes:

• Added a control-gate job to fail fast when manually dispatching the Build/Release workflow on the latest ref, preventing docker-ops from starting.
• Updated the Docker dependency updater workflow to disable auto-merge, and to apply labels + request the worker team as reviewer on generated PRs.
• Bumped actions/checkout from v6 to v7 in the touched workflows.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/docker-ops.yml	Adds a pre-job gate to block manual latest dispatches and updates checkout to v7.
.github/workflows/docker-dependency-updater.yml	Disables auto-merge for generated dependency PRs, adds labels/team review requests, updates checkout to v7, and grants issues: write for labeling.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.