The documented Dependabot auto-merge recipe merges a pull request with red checks when no check is required, and none is by default. I reproduced it on 18 October: merge state unstable, merged two seconds later.
Here the merge is triggered by the verification's own success instead. A red run does nothing, and the update waits for a person.
A red check that nothing requires is a comment, not a gate.
https://heyvaldemar.com/ai-agent-governance-decision-rights/