npm-registry `registries:` block silently dropped; `GITHUB_REGISTRIES_PROXY` empty despite valid secret

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Package ecosystem

npm

### Package manager version

npm (Node 24). Registry: `npm.pkg.github.com` (GitHub Packages).

### Language version

Node 24

### Manifest location and content before the Dependabot update

`apps/web/.npmrc`:

```
@oxbo-energy:registry=https://npm.pkg.github.com
//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}
```

`apps/web/package.json` declares `@oxbo-energy/auth-client@0.1.0` (private package published to `npm.pkg.github.com` under scope `@oxbo-energy`).

### dependabot.yml content

`.github/dependabot.yml` — relevant excerpts:

```yaml
version: 2

registries:
oxbo-energy-npm:
type: npm-registry
url: https://npm.pkg.github.com
username: x-access-token
password: ${{secrets.NPM_REGISTRY_TOKEN}}

updates:
- package-ecosystem: npm
directory: /apps/web
registries:
- oxbo-energy-npm
schedule:
interval: weekly
groups:
dev-deps:
dependency-type: development
```

The Dependabot repo secret `NPM_REGISTRY_TOKEN` is set (Classic PAT with `read:packages` scope). Verified authenticated 200 via `curl -H "Authorization: token $NPM_REGISTRY_TOKEN" https://npm.pkg.github.com/@oxbo-energy/auth-client`.

Also tried the `token:` form (`token: ${{secrets.NPM_REGISTRY_TOKEN}}`) — same behavior.

### Updated dependency

Any transitive rebase (`@dependabot rebase`) on npm PRs in `/apps/web`. Reproduces on multiple PRs whose lockfile conflicts with `main` after another npm PR merged.

### What you expected to see, versus what you actually saw

**Expected:** Dependabot resolves `NPM_REGISTRY_TOKEN` into the job environment, uses the configured `oxbo-energy-npm` registry to install `@oxbo-energy/*` packages, and successfully rebases the lockfile.

**Actual:** The `registries:` block is silently dropped by the orchestrator. The Dependabot job env shows:

```
GITHUB_REGISTRIES_PROXY:
Failed to parse GITHUB_REGISTRIES_PROXY environment variable
credentials-metadata: [{"type":"git_source","host":"github.com"}]
```

Only `git_source` credentials are populated; no `npm_registry` credential appears in `credentials-metadata` despite the config being valid YAML with the correct secret name. `@dependabot rebase` comments no-op silently — no reaction, no error posted on the PR, the head SHA doesn't move. The auth-failure surface is only visible in the raw actions/runs job logs (`gh api repos/OWNER/REPO/actions/runs/RUN_ID/logs`), not in any PR-side signal.

The behavior is identical for both variants of the credential form:

```yaml
# Variant A — token
token: ${{secrets.NPM_REGISTRY_TOKEN}}

# Variant B — username/password
username: x-access-token
password: ${{secrets.NPM_REGISTRY_TOKEN}}
```

Both are documented as valid for `type: npm-registry` per the [Dependabot config schema](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#npm-registry). Neither results in the secret being injected into the job env.

The dependabot secret IS present (`gh api repos/OWNER/REPO/dependabot/secrets` returns `NPM_REGISTRY_TOKEN`), so the config-parse layer is dropping the block silently before the secret-substitution stage.

### Native package manager behavior

`npm install --package-lock-only --ignore-scripts` in the same repo with `NODE_AUTH_TOKEN=$NPM_REGISTRY_TOKEN` succeeds and produces the correct lockfile update. This is the workaround we've been using — manual rebase-and-force-push, per-PR, run locally by a maintainer with local registry access. Every weekly Dependabot npm scan requires this workaround to merge, defeating the point of scheduled updates.

### Images of the diff or a link to the PR, issue, or logs

- Repo: OXBO-Energy/Ro-k (private).
- Two PRs attempting the fix from the config side, both landed but both non-functional: PR #23 (`token:` variant), PR #24 (`username:/password:` variant).
- Failing rebase attempts: PRs #12, #13, #16, #17, #18 (5 PRs stuck by lockfile conflicts on `apps/web`, all classified `safe_to_merge` after independent review, none automatically mergeable because their rebases silently no-op).
- Repro visible in any Dependabot job run's log — search for `GITHUB_REGISTRIES_PROXY` and `credentials-metadata`.

### Smallest manifest that reproduces the issue

Two files + one secret + one triggered rebase:

1. `.github/dependabot.yml` with the `registries:` block above.
2. `apps/web/.npmrc` scoping `@oxbo-energy` to `npm.pkg.github.com`.
3. Repo secret `NPM_REGISTRY_TOKEN` (Dependabot scope) set to a valid GitHub PAT with `read:packages`.
4. Any `apps/web` npm Dependabot PR whose lockfile has since gone stale — request rebase via `@dependabot rebase`.

Observed: rebase silently no-ops. Job logs show `GITHUB_REGISTRIES_PROXY: `.

### Summary of the ask

The `registries:` config block appears to be dropped before secret substitution runs. Please either:

1. Surface the parse/config error on the PR (not just in raw action logs) so consumers know their config is broken.
2. Fix the substitution so a valid `registries:` block populates `GITHUB_REGISTRIES_PROXY` with the configured credentials.

Right now, valid YAML + valid PAT + valid secret name = silent failure with no user-visible signal, which makes it look like `@dependabot rebase` is just broken. This bites any org using `npm.pkg.github.com` as a private registry for `@scope/*` packages consumed by Dependabot-updated projects.