ci(dependabot): auto-retarget dependabot PRs from main to Dev_new_gui (#11696)

[mrveiss]

Closes #11696

Thinking Path

Dependabot security updates always open against the default branch (main) and ignore dependabot.yml target-branch — a documented GitHub limitation. Manual retargeting reverts on the next @dependabot rebase (observed on #11566). Owner decision on #11696: retarget the PRs (option 2 in the issue). A workflow that re-applies the retarget on every PR event, including synchronize, makes the retarget rebase-proof.

What Changed

• New .github/workflows/dependabot-retarget.yml: on pull_request_target (opened/reopened/synchronize), if the PR author is dependabot[bot] and base is main, PATCH the base to Dev_new_gui. Comments once on open/reopen; on failure (e.g. Dev_new_gui already carries the bump → empty diff) it comments with the superseded-close instruction instead of failing silently.
• Security: github-script API calls only — no run: shell interpolation of untrusted input, PR code never checked out, pull-requests: write is the only permission.

Verification

• yaml.safe_load parses the workflow cleanly (YAML-OK).
• Condition/permissions mirror the existing dependabot-auto-merge.yml patterns (actions/github-script@v9, secrets.GITHUB_TOKEN).
• Live verification happens on the next Dependabot security PR — expected: base flips to Dev_new_gui automatically and stays there after a rebase (Dependabot PRs target main and revert manual retarget on rebase — bypass Dev_new_gui-first workflow #11696 acceptance).

Model Used

Claude Fable 5

[github-actions]

✅ SSOT Configuration Compliance: Passing

🎉 No hardcoded values detected that have SSOT config equivalents!