Dependency automation cannot land updates without intervention

> 🤖 Generated by the Agentic Engineer

Dependency automation in this repository is currently unable to land anything. This Epic exists because the individual failures look unrelated on their own, and only the census makes the pattern visible.

### Evidence

Measured 2026-09-01: **7 open PRs, 6 of them dependency or release PRs, and not one can reach merge.** They split into four distinct causes, three of which are ours:

| Cause | Blocked PRs | Ours? |
|---|---|---|
| #6818 — two malformed `{ "optional": true }` stub entries in `docs/package-lock.json` that dependabot drops on regen | #6791, #6794 | yes |
| #6817 — CodeQL default setup fails on a runner shutdown and **cannot be re-run** (`403`), so a transient blip permanently blocks a required check | #6808, #6814 | yes |
| #6816 — grouped gomod updates skip `desktop/go.mod`, so the grouped PR fails `Verify Desktop Module Tidy` | #6813 | yes |
| #6728 — `loft-sh/apiserver` pins k8s 0.36 while Talos ≥`beta.0` needs 0.37 | #6724, #6796, #6813 | no (genuine upstream wall) |

Each has been individually root-caused and each blocked PR is parked on its named blocker.

### Why this is worth an Epic rather than three separate fixes

The three in-house causes share a shape: **an automated dependency update produces a state its own automation cannot recover from.** The lockfile regeneration drops entries the previous run left behind; the CodeQL check offers no retry path; the grouped update touches a subset of the files the ungrouped ones do. In every case the bot did what it was configured to do and the result was unmergeable, with no self-healing route.

That matters beyond the six PRs currently stuck: dependency updates are how this repository takes security fixes. A queue that cannot drain is a security-latency problem, not just an upkeep annoyance.

### Success signal

Dependency and release PRs return to draining without agent intervention: the ksail queue holds no PR blocked for an in-house reason for a sustained period, and the three child defects are closed or demonstrably no longer reachable. #6728 is explicitly out of scope — it is a real upstream constraint and correctly parked.

### Children

Decomposed as sub-issues: #6816, #6817, #6818. #6728 stays independent as an upstream blocker.

Start by reading child issues #6816, #6817, and #6818, then inspect the blocked PRs they name. The relevant entry points include docs/package-lock.json, desktop/go.mod, and the CodeQL default setup; done means the three in-house blockers are closed or no longer reachable and dependency and release PRs can drain without agent intervention.

Written by the indexing model from the issue text.