[dependabot:release-train-updater] dashboard/site eslint family patch bump blocked by create_pull_request no-commits error

`create_pull_request` failed twice for a validated dependency bump in `dashboard/site`, blocking delivery. Two materially different attempts were made (default payload, then with explicit `base: "main"`); both returned the identical tool-side error `"No changes to commit - no commits found"` despite the commit being verifiably present locally.

**Action:** A maintainer should investigate the `create_pull_request` safe-output pathway for commit detection in this repository (workspace-root live mode), or recover the preserved branch below and open the PR manually. Acceptance check: the branch's 2-file diff lands as a reviewable PR against `main`.

Blocked dependency bundle

- Ecosystem: npm
- Manifest(s): `dashboard/site/package.json`, `dashboard/site/package-lock.json`
- Bump: `eslint` 9.34.0 → 9.39.5, `@eslint/js` 9.34.0 → 9.39.5, `globals` 16.3.0 → 16.5.0 (all patch)
- Validation before hitting the tool failure: `npm run lint` clean, `npm run typecheck` clean, `npm test` 911/911 tests passed (86/87 suites; the 1 remaining suite failure is a pre-existing Vite/`node:sqlite` worker-pool limitation reproduced identically on unmodified `main`, unrelated to this bump).

Evidence the commit exists locally

- Branch: `dependabot-agent/dashboard-eslint-family-20260913132745`
- Commit: `5d769a4a` on top of `main`@`af47fc7f`
- `git diff origin/main --stat`: exactly 2 files changed, 6 insertions / 6 deletions
- `git status --short`: clean (only untracked `.local/`, `target/` unrelated to this change)

Attempts and errors

1. `create_pull_request` with `{title, body, branch}` → `{"result":"error","error":"No changes to commit - no commits found", ...}`
2. Retry with explicit `base: "main"` added → identical error.

Per the tool-retry-limit guidance (max 2 materially different attempts), no further retries were made this run.

Related prior occurrences (same repo, different bundles)

Multiple prior dependabot-release-train-updater cache entries for this repo report the identical `create_pull_request` "no commits found" tool-side error on validated, locally-committed diffs (e.g. runs on 2026-09-08 through 2026-09-13, including a dashboard/site eslint-family attempt on 2026-09-13-04-42-00 that hit the exact same error). This looks like a recurring, repo-specific or environment-specific gap in the `create_pull_request` commit-detection path rather than an isolated fluke.

Control Plane

- Correlation ID: 34759469796-256
- Central repo: githubnext/gh-aw-cao
- Run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34759469796

> Generated by [:dependabot: Dependabot / Release Trains](https://github.com/githubnext/gh-aw-cao/actions/runs/34759663363) · copilot · auto · 157.9 AIC · ⌖ 22.4 AIC · ⊞ 18.5K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fdependabot-release-train-updater%22&type=issues)
>

> - [x] expires on Sep 27, 2026, 1:34 PM UTC

Start with the create_pull_request safe-output pathway and reproduce the failure from branch dependabot-agent/dashboard-eslint-family-20260913132745 at commit 5d769a4a. Compare its commit detection with the workspace-root live mode, then verify done by opening a reviewable PR against main containing the 2-file dashboard/site diff.

Written by the indexing model from the issue text.