ci: sync lockfile in release PRs and skip AI disclosure on bot PRs

.github/workflows/release-with-changesets.yml

@@ -122,7 +122,10 @@ jobs:
         uses: changesets/action@v1
         id: release
         with:
-          version: npx -p @changesets/cli@2.27.7 changeset version
+          # `changeset version` only rewrites package.json/CHANGELOG files; it never runs an
+          # install, so the root package-lock.json drifts out of sync with the bumped manifests.
+          # Refresh the lockfile (lockfile-only, no scripts) so the release PR carries it too.
+          version: npx -p @changesets/cli@2.27.7 changeset version && npm install --package-lock-only --ignore-scripts
           commit: "chore(release): release and bump versions of packages"
           title: "chore(release): release and bump versions of packages"
           publish: npx -p @changesets/cli@2.27.7 changeset publish

.github/workflows/verify-ai-disclosure.yml

@@ -31,6 +31,11 @@ permissions:
 
 jobs:
   verify-ai-disclosure:
+    # it runs only if PR actor is not a bot, at least not a bot that we know
+    if: |
+      (github.event.pull_request.user.login != 'asyncapi-bot' && 
+      github.event.pull_request.user.login != 'dependabot[bot]' && 
+      github.event.pull_request.user.login != 'dependabot-preview[bot]') 
     runs-on: ubuntu-latest
     steps:
       - name: Check PR body for AI-assistance disclosure