fix: use admin merge when direct merge is blocked by branch policy

[tomqin93]

Summary

• When the release bot's direct gh pr merge --squash fails due to branch policy, try --admin merge first to leverage the app's ruleset bypass permissions
• Falls back to --auto merge only if admin merge also fails
• This fixes the release automation failing because the bot's approval doesn't satisfy the review requirement (bot has authorAssociation: NONE)

Context

The release failed because:

1. Bot approves the PR, but its approval doesn't count (not a repo collaborator)
2. Direct merge fails ("branch policy prohibits")
3. Auto-merge fails ("not authorized for this protected branch")

The --admin flag bypasses branch protection rules, which the bot should be able to use given its ruleset bypass configuration.

Test plan

• Next biweekly release cycle should merge Dependabot PRs automatically

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 35.09%. Comparing base (27c981d) to head (09bc90a).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1434   +/-   ##
=======================================
  Coverage   35.09%   35.09%           
=======================================
  Files          54       54           
  Lines        4029     4029           
=======================================
  Hits         1414     1414           
  Misses       2461     2461           
  Partials      154      154           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.