Drop @dependabot close comment from prerelease close path

[zkoppert]

Why

PR #38 made do_dependabot_close post @dependabot close AND force-close via gh pr close --delete-branch. The comment was kept so Dependabot's tracking would see the directive, but production evidence on the very first post-merge cron tick proves the comment is unnecessary noise:

• chore(deps): Bump python from 3.14.5-slim to 3.15.0b2-slim in the dependencies group github-community-projects/measure-innersource#193 was stuck in the same spam loop as contributors#496 - 27 prior @dependabot close comments from 2026-06-13 through 2026-06-15 20:09Z, none of which closed it.
• The post-merge cron tick at 22:01:56Z posted one final @dependabot close comment and then immediately called gh pr close --delete-branch. The PR closed at 22:01:58Z - 2 seconds later.
• The force-close did all the work. The @dependabot close comment was redundant decoration on the timeline.

Posting a redundant comment on every prerelease close adds clutter to PR timelines, sends an extra notification, and slightly increases the audit-log noise from the bot account. I dropped it.

What changed

• do_dependabot_close now makes exactly one subprocess call: gh pr close --repo <repo> <number> --delete-branch.
• The same narrow _is_already_closed_stderr try/except still wraps the close call. Auth, rate limit, timeout, and branch-deletion failures continue to propagate so the outer run loop records them and the next cron tick retries.
• The dry-run log line was simplified to match.
• I added test_do_dependabot_close_does_not_post_dependabot_close_comment as an explicit regression guard. It inspects every run_gh call from inside the function and asserts no pr comment call is ever made. If a future change drifts a comment back in, this test fails immediately.
• I updated test_do_dependabot_close_swallows_already_closed_error from call_count == 2 to 1, replaced the old two-call assertion test with a single-call equivalent, and refreshed docstrings in triage_dependabot.py, tests.py, README.md, and SKILL.md.

Testing

• All 214 tests pass locally (python3 -m pytest tests.py -q, 213 → 214 with the new regression guard).
• pyflakes clean.
• Multi-model review (Opus 4.7 + Sonnet 4.6 + GPT 5.5) all returned "no significant issues". All three reviewers verified the error-propagation paths and cooldown invariants are preserved.

Rollout

• Merge, then the next hourly cron tick picks up the new code automatically. No PRs need closing at the moment (both known prerelease PRs - contributors#496 and measure-innersource#193 - already closed during the fix(triage-dependabot): force-close prerelease PRs + preserve cooldown on mark-done flakes #38 monitoring window).
• The next freshly opened prerelease Dependabot PR will be the validation: it should close via gh pr close with zero PR comments from me.
• I will keep the existing post-fix(triage-dependabot): force-close prerelease PRs + preserve cooldown on mark-done flakes #38 monitoring schedule running through its 10-hour window so I can confirm both (a) zero @dependabot close comments are posted by me on any new prerelease PR and (b) any new prerelease PR closes on the first cron tick.

What to watch after merge

• I will spot-check the next triage-dependabot.log cron tick that has closed_prerelease >= 1 to confirm the closed PR has no @dependabot close comment authored by me near the close timestamp.

[Copilot]

Pull request overview

This PR simplifies the prerelease close path in the triage-dependabot skill by removing the redundant @dependabot close comment that was posted before force-closing the PR. Production evidence showed Dependabot ignoring that comment for hours, and the direct gh pr close --delete-branch was doing all the work - making the comment pure timeline noise and notification spam.

Changes:

• Removed the run_gh(["pr", "comment", ...]) call from do_dependabot_close, leaving only the gh pr close --delete-branch API call
• Added a regression guard test (test_do_dependabot_close_does_not_post_dependabot_close_comment) and updated existing test assertions to reflect the single-call behavior
• Updated docstrings, README, and SKILL.md to document the simplified close-prerelease path

Show a summary per file

File	Description
.copilot/skills/triage-dependabot/triage_dependabot.py	Removed the @dependabot close comment call and updated the function docstring to reflect single-step close behavior
.copilot/skills/triage-dependabot/tests.py	Renamed/updated existing test, added regression guard test, adjusted call_count assertions from 2→1, refreshed docstrings
.copilot/skills/triage-dependabot/SKILL.md	Updated the close-prerelease outcome description to remove mention of the comment step
.copilot/skills/triage-dependabot/README.md	Updated decision table and detailed prerelease section to reflect comment removal

Copilot's findings

• Files reviewed: 4/4 changed files
• Comments generated: 0