Make the merge lane's Dependabot verdict a required check on develop

Task 7932 queues every Dependabot PR into develop on the merge lane (`.github/workflows/dependabot-lane.yml`) and the lane full-gates it, merges it only green, and comments on a failure. A human with approval can still merge a Dependabot PR by hand before the lane's verdict, because no required check carries that verdict: `jaah-forge` has no commit-status verb, and `protect-develop` declares no required check. Ask: - Add a `jaah-forge` verb that sets a commit status on a PR head (GitHub first), and have `tools/merge_lane.py` post `merge-lane` pending when it takes a row, success after the gate passes and before `pr merge --sha`, and failure on a red verdict. - Declare that context as required in `infra/github/rulesets/develop.json` only once every develop PR gets it (lane ON for all of them), so lane-OFF runner PRs aren't blocked forever. The owner runs the apply. Out of scope: which versions Dependabot pins; `.github/dependabot.yml` grouping. Done means: - A Dependabot PR into develop shows a `merge-lane` status that is pending until the lane's full gate passes, and GitHub refuses a manual merge while it's pending or failed. Required checks: ./dc check full

Added `jaah-forge pr status`; the merge lane posts `merge-lane` pending/success/failure; protect-develop requires it (owner applies). Quick gate + lane/forge tests green; PR #6249 queued on the lane. Follow-up draft #8005 (integration_id pin, non-runner PRs).