Dependabot alerts stay open right after merge — re-scan auto-closes

Trap: right after a security-fix PR merges, its Dependabot alerts still show OPEN — looks like the fix didn't take, which invites an immediate re-fix. Dependabot must re-scan the default branch post-merge and typically auto-closes fixed alerts within minutes. Fix: do NOT re-trace chains or open a new fix PR immediately after merge; schedule a ~5-minute re-check, then reconcile which alerts actually closed vs. remained. Remaining ones are genuinely unfixed (e.g. the still-open js-yaml/smol-toml/cookie/brace-expansion/svgo set on getsentry/craft [[019fdd1b-e108-7cf6-b74e-64921a4750a1]]). Complements the merge pipeline [[019fdd20-3623-7c80-9987-2ee77f26354f]], which says investigate NEW alerts — this clarifies timing for pre-existing ones.