…ce tests (#802)

## Motivation

Every Dependabot PR fails CI on two jobs, Service Tests and Notebook
Validation, regardless of what it bumps. Dependabot pushes its branches
to this repository, so its PRs pass the same-repository guard that keeps
fork PRs away from secret-dependent jobs. GitHub, however, gives runs
that Dependabot triggers no Actions secrets, so those jobs start with
every API key empty. On #751, Service Tests stops at the Google Cloud
authentication step for want of `GOOGLE_CREDENTIALS`, and the notebooks
fall through to `getpass` prompts that cannot run in CI. The same two
jobs failed on #744, #749, #751 and #799.

## Changes

This PR treats Dependabot PRs the way fork PRs are already treated: the
secret-dependent jobs skip, and a maintainer runs them with secrets
after reading the change.

- `.github/workflows/test.yml`: Service Tests and Notebook Validation
also skip when `github.actor` is `dependabot[bot]`. The guard keys on
the actor because that is what GitHub withholds secrets on, so a
maintainer's push to a Dependabot branch still runs both jobs with
secrets.
- `.github/workflows/test-fork-pr.yml`: the dispatch-only workflow now
accepts PRs opened by `dependabot[bot]` as well as fork PRs, and still
rejects other same-repository PRs.
- `CONTRIBUTING.md`: a short section telling maintainers to run `gh
workflow run test-fork-pr.yml -f pr_number=<n>` before merging a fork or
Dependabot PR.

## Notes

- A skipped job shows as passing, so the manual dispatch is a
convention, not an enforced gate. Copying the API keys into the
Dependabot secrets store would make the jobs run automatically, but it
would also hand those keys to newly bumped dependency code before anyone
has reviewed it, which defeats the purpose of waiting for a maintainer.
- The check run keeps the name "Fork PR - Service Tests" so that any
branch-protection rule or tooling referring to it keeps matching.
- Notebook Validation has no manual equivalent, as is already the case
for fork PRs. It still runs on `main` after merge and nightly.

## Reviewer Brief

**Start here:** `.github/workflows/test.yml:25`, the Service Tests `if:`
guard. It decides which PR runs get secret-dependent jobs, and the
Notebook Validation guard at `:152` repeats it.

**Where it could fail**
- `.github/workflows/test-fork-pr.yml:46-51`: the new acceptance checks
who opened the PR (`pr.data.user.login`), not who wrote its commits, so
a write-access user's commit on a Dependabot branch would also be tested
with secrets; that user can already run code with secrets from any
same-repository branch.

**Not verified:** neither workflow has run with this change. The
`github.actor` guard and the Dependabot acceptance in `test-fork-pr.yml`
can only be confirmed on a real Dependabot PR plus a manual dispatch.
actionlint was not available; both files parse as YAML, and the `setup`
script passes `node --check`.

**Beyond CI:** the logs of run 37937957172 (#751) show every secret
empty on a Dependabot-triggered run, Service Tests failing at Google
Cloud authentication, and Notebook Validation failing on `getpass`
API-key prompts, which confirms that both jobs need secrets and lose no
working coverage by skipping.

**Since the last brief:** `a59789b7` passes `GEMINI_API_KEY` to the
dispatched service tests, matching `test.yml`, so the Google GenAI
fixture exercises the Gemini backend there too.

<sub>Reviewed `d8a7d3a7` · Claude Code (claude-opus-5-5) · lenses:
correctness, security, design, tests, docs, Redis behaviour</sub>

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Workflow and contributor-doc changes only; no application or
secret-handling logic changes, though skipped jobs still report as
passing until a maintainer runs the dispatch workflow.
> 
> **Overview**
> Dependabot PRs were hitting **Service Tests** and **Notebook
Validation** with no Actions secrets (same-repo branches, but GitHub
withholds secrets on Dependabot-triggered runs), so CI failed on empty
API keys. This PR aligns Dependabot with the existing fork PR pattern.
> 
> **`test.yml`** skips those secret-dependent jobs when `github.actor`
is `dependabot[bot]` (while still running them for maintainer pushes on
the same branch). **`test-fork-pr.yml`** now allows manual dispatch for
Dependabot PRs as well as forks, with updated validation and comments.
**`CONTRIBUTING.md`** documents running `gh workflow run
test-fork-pr.yml -f pr_number=<n>` before merge.
> 
> The fork-pr workflow also wires **`GEMINI_API_KEY`** into the
service-tests env alongside the other provider secrets.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
a59789b. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->