Skip commit-log for Dependabot pull requests
The commit-log job runs check-commit-log.sh over every commit in a pull request, but Dependabot writes its own messages (release-note links, a fixed signoff) and rewording them stops it from rebasing the branch, so its PRs can never pass. The job is now skipped when the PR author is dependabot[bot]. The exemption keys on the PR author rather than github.actor, because the actor is whoever last triggered the run and would change when a maintainer re-runs the job. A skipped job concludes "skipped", which branch protection accepts for a required check.
The check, audit and check-size jobs are untouched, so a Dependabot bump is still built, tested and audited in full. Only the commit-message gate is bypassed.
Verified locally: the workflow parses as YAML and the if expression evaluates to the intended string, scripts/indent.sh reports formatting clean, and the commit hooks accepted the commit. The skip itself can only be confirmed on a real Dependabot pull request, which is the next one to open. Agy and Codex both reviewed the diff and found no defects.
Summary by cubic
Skips the commit-log job for Dependabot pull requests and fixes the scanner bench for criterion 0.8.
Dependabot writes its own commit messages, and rewording them prevents it from rebasing the branch, so its PRs can never satisfy the commit-message rules. The exemption keys on the PR author rather than the actor, because the actor changes whenever a maintainer re-runs the job. The check, audit, and check-size jobs still run for Dependabot, so the bump remains fully validated; only the commit-message gate is bypassed.
Switches benches/scanner.rs to std::hint::black_box, which criterion 0.8 deprecates in favor of the standard library one; the clippy lanes run with warnings denied, so the deprecation broke make check.