fix(workflows): fix IS_PRERELEASE bug, hotfix changelog, dependabot target, back-merge automation, lint gate, and manifest version mismatch

- fix version-bump.yml: IS_PRERELEASE was never defined, breaking iterative beta versioning (7.x.x-beta.1 → 7.x.x-beta.2)
- fix hotfix-release.yml: move changelog generation before merge so git log captures commits correctly
- fix dependabot.yml: was empty; now targets dev branch to keep Dependabot PRs in the normal dev→beta→main flow
- fix automerge.yml: remove continue-on-error from lint step so lint failures block Dependabot auto-merge; pin bun-version to 1.3.1
- fix production-release.yml: add automated back-merge of main→beta and main→dev after each production release
- fix manifest/chrome.json and manifest/firefox.json: version was 7.6.0, mismatched package.json 7.6.1

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/version-bump.yml

@@ -58,8 +58,12 @@ jobs:
           MINOR="${VERSION_PARTS[1]}"
           PATCH="${VERSION_PARTS[2]}"
           
-          # If requesting a pre-release and current is already a pre-release, keep base version
-          # Otherwise, bump the version based on type
+          if echo "$CURRENT_VERSION" | grep -q '\-'; then
+            IS_PRERELEASE="true"
+          else
+            IS_PRERELEASE="false"
+          fi
+
           if [ -n "${{ github.event.inputs.pre_release }}" ] && [ "$IS_PRERELEASE" = "true" ]; then
             # Keep existing base version for iterative betas (7.6.0-beta.1 -> 7.6.0-beta.2)
             NEW_VERSION="$BASE_VERSION"