[dependabot:release-train-updater] create_pull_request fails with no changes to commit for self-target dependency updates

`create_pull_request` fails with `"No changes to commit - no commits found"` for
`githubnext/gh-aw-cao` self-target dependency updates, even though the branch has a
verified, non-empty commit ahead of `origin/main`.

## Prepared fix (blocked from landing as a PR)

**Manifests:** `package.json`, `package-lock.json` (root)
**Change:** bump `astro` 7.3.1 → 7.3.2 and `@astrojs/markdown-remark` 7.3.0 → 7.3.1
(patch releases, 2026-09-08, upstream-paired — astro@7.3.2 depends on
`@astrojs/markdown-remark: "^7.3.0"`).

**Validation performed:**
- `npm view astro@ dependencies --json` vs `@` and same for
`@astrojs/markdown-remark`: identical dependency lists both times — pure patch
bump, no transitive tree churn.
- `npm install --package-lock-only --registry=https://registry.npmjs.org/
--ignore-scripts`: regenerated lockfile cleanly.
- `npm audit --package-lock-only --json` before/after: identical 5 findings
(1 high, 4 moderate — the known, previously reviewed undici/`@actions/github`
devDependency chain from PR #3980; confirmed unrelated/not worsened).
- Both files confirmed valid JSON via `python3 json.load`.
- Diff confirmed scoped to exactly 2 files (`package.json` +4/-2,
`package-lock.json` +50/-11 net) via `git diff origin/main HEAD --stat`.

**Manual apply instructions:** update the two version strings in `package.json`
(lines for `astro` and `@astrojs/markdown-remark`) and run
`npm install --package-lock-only` to regenerate `package-lock.json`.

## Repeated tool failure — now 3 confirmed occurrences

`create_pull_request` returned the same error both before and after adding an
explicit `base: "main"` parameter:
```
{"result":"error","error":"No changes to commit - no commits found"}
```

Pre-conditions verified immediately before each attempt (not just after):
- `git log origin/main..HEAD --oneline` showed exactly 1 non-empty commit.
- `git diff origin/main HEAD --stat` showed exactly 2 changed files.

This is the **3rd confirmed occurrence** of this exact failure signature for
`githubnext/gh-aw-cao` specifically, in the self-target scenario where the
workspace root is checked out directly as the target repo (as opposed to a
separate `target/` checkout, which has reported success for other target
repositories in prior runs):

1. 2026-09-10 07:55 UTC — undici override fix (branch
`dependabot-agent/undici-security-fix-20260910075319`, commit `a55c2420`,
diff 41+/34- lines). Escalated via issue at the time (that candidate was later
found in a subsequent run to be an intentionally-deferred/reviewed decision per
PR #3980, unrelated to this tooling bug).
2. 2026-09-10 14:37 UTC — this same astro/markdown-remark bump (branch
`dependabot-agent/astro-patch-update-20260910143721`, commit `2a99fe87`,
diff 50+/11- lines). Escalated via issue at the time.
3. 2026-09-10 18:36 UTC (this run) — same astro/markdown-remark bump repeated on a
fresh branch (`dependabot-agent/astro-patch-update-20260910183608`, commit
`fbfac1dc`) after confirming via `npm view` that the fix is still current and
not superseded. Same error, both with and without explicit `base`.

Three different diffs/branches/commits, same error every time, specific to this
repository's self-target scenario — this looks like a systemic bug in the
`create_pull_request` safe-output tool's patch-generation path for this
workflow/repo combination, not something caused by diff size or content.

## Recommended next steps

- A maintainer/human should manually apply the prepared fix above (2-line
`package.json` edit + lockfile regeneration) since the automated path is
currently blocked.
- Investigate why `create_pull_request` cannot find commits ahead of
`origin/main` specifically when `githubnext/gh-aw-cao` is both the workspace
root and the target repo, despite `git` confirming the commit exists locally.
- Until this is fixed, future dependency-release-train runs on this repo should
stop attempting `create_pull_request` for self-target candidates after one
verification attempt (per the repeated 3-strikes pattern here), and escalate
directly instead of repeating the 2-attempt retry cycle each time.

### Control Plane
- Correlation ID: 34514173388-189
- Central repo: githubnext/gh-aw-cao
- Run URL: https://github.com/githubnext/gh-aw-cao/actions/runs/34514173388

> Generated by [:dependabot: Dependabot / Release Trains](https://github.com/githubnext/gh-aw-cao/actions/runs/34514645349) · copilot · auto · 110.5 AIC · ⌖ 9.46 AIC · ⊞ 18.1K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fdependabot-release-train-updater%22&type=issues)
>

_{Add this agentic workflow to your repo}

To install this agentic workflow, run

```
gh aw add githubnext/gh-aw-cao/.github/workflows/dependabot-release-train-updater.md@main
```

> - [x] expires on Sep 24, 2026, 6:40 PM UTC

Start with the dependabot-release-train-updater workflow and its create_pull_request invocation, then reproduce the self-target case using the recorded git log and diff checks. Compare it with the separate target/ checkout behavior mentioned in the issue. Done means a verified commit ahead of origin/main can create a pull request, or the workflow stops retrying and escalates after one failed verification.

Written by the indexing model from the issue text.