All version update PRs includes unrelated security fixes

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Package ecosystem

pnpm

### Package manager version

10.32.1

### Language version

_No response_

### Manifest location and content before the Dependabot update

_No response_

### dependabot.yml content

```
version: 2
updates:
- package-ecosystem: "npm"
directory: "/"
schedule:
interval: "daily"
groups:
dev-dependencies:
dependency-type: "development"
exclude-patterns:
- "@playwright*" # To avoid false errors due to playwright change
- "vite" # to exclude major vite upgrades
- "@types/node" # noisy and handled manually
astro:
patterns:
- "astro"
- "@astrojs/*"
expressive-code:
patterns:
- "astro-expressive-code"
- "@expressive-code/*"
iconify-icons:
patterns:
- "@iconify-json/*"
```

### Updated dependency

_No response_

### What you expected to see, versus what you actually saw

Dependabot have started to include security update overrides for open alerts in **every** dependency version update pull requests, unexpected and without mentioning it.

E.g. `Bump astro from 6.3.3 to 6.3.5 (via audit fix) in the astro group` updates package.json from `"astro": "6.3.3"` to `"astro": "6.3.5"` as expected, but `pnpm-lock.yaml` includes the following which breaks my builds:
```
overrides:
yaml@>=2.0.0 <2.8.3: '>=2.8.3'
```

The same occurs for other version upgrades like `Bump @iconify-json/octicon from 1.2.23 to 1.2.24 (via audit fix) in the iconify-icons group across 1 directory`.

The private repo has an open security alert for the `yaml` dependency, and `Dependabot security updates` is enabled, but I'm expecting the security updates in dedicated PRs.

The behavior started this week and all affected PRs includes ` (via audit fix)` in the title and the feature flag `"enable-audit-fix-fallback":true` in dependabot workflow logs, pointing in the direction of #14589.

### Native package manager behavior

Not applicable

### Images of the diff or a link to the PR, issue, or logs

**Dependabot action log** doesn't mention updating `yaml`, but it runs the `audit --fix`
```
updater | 2026/05/19 02:36:51 INFO Process PID: 2037 completed with status: pid 2037 exit 0
updater | 2026/05/19 02:36:51 INFO Total execution time: 3.45 seconds
updater | 2026/05/19 02:36:51 INFO Started process PID: 2051 with command: {} corepack pnpm audit --fix {}
proxy | 2026/05/19 02:36:52 [696] POST [https://registry.npmjs.org:443/-/npm/v1/security/audits/quick](https://registry.npmjs.org/-/npm/v1/security/audits/quick)
proxy | 2026/05/19 02:36:52 [696] 200 [https://registry.npmjs.org:443/-/npm/v1/security/audits/quick](https://registry.npmjs.org/-/npm/v1/security/audits/quick)
updater | 2026/05/19 02:36:52 INFO Process PID: 2051 completed with status: pid 2051 exit 0
updater | 2026/05/19 02:36:52 INFO Total execution time: 0.95 seconds
updater | 2026/05/19 02:36:52 INFO Started process PID: 2064 with command: {} corepack pnpm install --lockfile-only {}
....

updater | 2026/05/19 02:37:25 INFO Finished job processing
updater | 2026/05/19 02:37:25 INFO Results:
+-----------------------------------------+
| Changes to Dependabot Pull Requests |
+---------+-------------------------------+
| created | astro ( from 6.3.3 to 6.3.5 ) |
+---------+-------------------------------+
Cleaned up container 9efa4a17e5869a7f4ffa630ecd0457af29ab2500343c2f88a0a7a6a197697569
proxy | 2026/05/19 02:37:25 223/937 calls cached (23%)
2026/05/19 02:37:25 Posting metrics to remote API endpoint
proxy | 2026/05/19 02:37:25 Successfully posted metrics data via api client
```

### Smallest manifest that reproduces the issue

_No response_