Dependabot PRs against main fail CI (NPM build) without a manual /compile

Every open Dependabot PR targeting `main` fails the `NPM build` check's "Check build changes" step (e.g. #94, bumping axios). Dependabot only touches `package.json`/`package-lock.json` — it never runs `npm run build`, so the committed `js/`/`css/` bundle goes stale relative to the new dependency tree, and the workflow's post-build `git status --porcelain` diff check fails.

This is specific to `office` being a shipped, non-appstore app: compiled assets have to live in git (see #9, "for shipping the app we need to have compiled assets in the repo"), unlike a typical App Store app where the store's own pipeline builds at packaging time and contributors keep `js/`/`css/` out of the repo entirely.

Fix per PR: comment `/compile` (the `command-compile.yml` bot) before merging, so it recompiles and commits fresh assets. This needs to happen on every dependency-bump PR against `main` (and `stable34`), not just source PRs.

Worth considering as a follow-up: have Dependabot (or a scheduled job) auto-comment `/compile` on its own PRs so this isn't a manual step every time.

Start with the NPM build workflow and command-compile.yml, then inspect how Dependabot PRs and the /compile bot interact with generated js/ and css/ assets. Reproduce the Check build changes failure on a dependency-bump PR; done means dependency PRs targeting main and stable34 can pass without a manual compile comment while committed assets remain current.