Fix generated PR author policy

[danielporterda]

What changed

• require generated auto-merge PRs to be authored by app/cf-docs-generated-docs-merger
• update the existing policy coverage for the merger App identity
• add a regression test that rejects the legacy app/github-actions identity

Root cause

PR #1201 moved generated PR mutations from GITHUB_TOKEN to the merger GitHub App, but the auto-merge safety validator continued to require app/github-actions. Scheduled run https://github.com/canton-network/cf-docs/actions/runs/31019375817 therefore created valid App-authored PRs #1230 and #1231 and then rejected them before auto-merge.

Validation

• 42 passed in tests/test_update_generated_reference_prs.py
• 6 passed, 36 deselected for generated-PR policy and merge-path tests
• Python compilation and git diff --check
• live policy CLI passed against App-authored PR Update gRPC Ledger API reference #1230 at 3694303700399e3ee81a4e16ef276216c87ff51f
• live policy CLI passed against App-authored PR Update Canton protobuf history reference #1231 at 64e5d08d2d9736237314a30b9bb8cae2acfe6738

Local .envrc setup was attempted first; this machine does not provide nix-shell, so focused tests ran in an isolated Python environment from .[dev].