fix(github-ops): synchronize localized merge authority

docs/ja-JP/skills/github-ops/SKILL.md

@@ -126,11 +126,11 @@ gh api repos/{owner}/{repo}/dependabot/alerts --jq '.[].security_advisory.summar
 # Check secret scanning alerts
 gh api repos/{owner}/{repo}/secret-scanning/alerts --jq '.[].state'
 
-# Review and auto-merge safe dependency bumps
+# Review dependency bumps — merging is a user-authorized action (propose, never auto-merge)
 gh pr list --label "dependencies" --json number,title
 ```
 
-- Review and auto-merge safe dependency bumps
+- Review safe dependency bumps and propose merges for user approval — never auto-merge
 - Flag any critical/high severity alerts immediately
 - Check for new Dependabot alerts weekly at minimum
 

docs/zh-CN/skills/github-ops/SKILL.md

@@ -126,11 +126,11 @@ gh api repos/{owner}/{repo}/dependabot/alerts --jq '.[].security_advisory.summar
 # Check secret scanning alerts
 gh api repos/{owner}/{repo}/secret-scanning/alerts --jq '.[].state'
 
-# Review and auto-merge safe dependency bumps
+# 审查依赖项更新并提交给用户批准，切勿自动合并
 gh pr list --label "dependencies" --json number,title
 ```
 
-* 审查并自动合并安全的依赖项更新
+* 审查安全的依赖项更新并提交给用户批准，切勿自动合并
 * 立即标记任何严重/高严重性告警
 * 至少每周检查一次新的 Dependabot 告警
 

tests/docs/github-ops-merge-authority.test.js

@@ -0,0 +1,45 @@
+'use strict';
+
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+
+const repoRoot = path.resolve(__dirname, '..', '..');
+const policyDocs = [
+  {
+    path: 'skills/github-ops/SKILL.md',
+    approval: 'user approval',
+    prohibition: 'never auto-merge',
+  },
+  {
+    path: 'docs/ja-JP/skills/github-ops/SKILL.md',
+    approval: 'user approval',
+    prohibition: 'never auto-merge',
+  },
+  {
+    path: 'docs/zh-CN/skills/github-ops/SKILL.md',
+    approval: '用户批准',
+    prohibition: '切勿自动合并',
+  },
+];
+
+console.log('\n=== Testing GitHub operations merge authority ===\n');
+
+for (const policy of policyDocs) {
+  const content = fs.readFileSync(path.join(repoRoot, policy.path), 'utf8');
+
+  assert.ok(content.includes(policy.approval), `${policy.path} must require user approval`);
+  assert.ok(content.includes(policy.prohibition), `${policy.path} must prohibit auto-merge`);
+  assert.ok(
+    !content.includes('Review and auto-merge safe dependency bumps'),
+    `${policy.path} must not authorize auto-merging dependency bumps`
+  );
+  assert.ok(
+    !content.includes('审查并自动合并安全的依赖项更新'),
+    `${policy.path} must not authorize auto-merging dependency bumps`
+  );
+
+  console.log(`  ✓ ${policy.path}`);
+}
+
+console.log(`\nPassed: ${policyDocs.length}`);