Fix dependency auto-merge workflow env contract test (#5507)

# What does this implement/fix?

#5499 added a `refresh-stale` job that mints a GitHub App token, so
`auto-merge-dependency-updates.yml` gained `EXPECTED_APP_SLUG` and
`EXPECTED_APP_INSTALLATION_ID` in its top-level `env`.
`test_dependency_auto_merge_enforces_app_bot_identity_contract` asserts
that
`env` mapping exactly and still listed only the three bot-login
constants, so
`dev` is red.

That assert is the first one in the test, so every later assertion in
the
function was skipped in CI as well.

## Changes

- Add both constants to the expected `env` mapping.
- Assert that the `Verify GitHub App identity` step of `refresh-stale`
compares
against both, so the new constants stay covered instead of only
declared.

**Related issue (if applicable):**

- related issue <link to issue>

## Types of changes

<!--
Tick exactly one box. CI (.github/workflows/pr-labels.yaml) derives
the label from the ticked box and applies it automatically; the
release-notes generator uses that same label to slot this change
into the next release notes.
-->

- [ ] Bugfix (non-breaking change which fixes an issue) — `bugfix`
- [ ] New feature (non-breaking change which adds functionality) —
`new-feature`
- [ ] Enhancement to an existing feature — `enhancement`
- [ ] New music/player/metadata/plugin provider — `new-provider`
- [ ] Breaking change (fix or feature that would cause existing
functionality to not work as expected) — `breaking-change`
- [ ] Refactor (no behaviour change) — `refactor`
- [ ] Documentation only — `documentation`
- [ ] Maintenance / chore — `maintenance`
- [x] CI / workflow change — `ci`
- [ ] Dependencies bump — `dependencies`

## Checklist

- [x] The code change is tested and works locally.
- [x] `pre-commit run --all-files` passes.
- [x] `pytest` passes, and tests have been added/updated under `tests/`
where applicable.
- [ ] For changes to shared models, the companion PR in
`music-assistant/models` is linked.
- [ ] For changes affecting the UI, the companion PR in
`music-assistant/frontend` is linked.
- [x] I have read and complied with the project's [AI
Policy](https://github.com/music-assistant/.github/blob/main/AI_POLICY.md)
for any AI-assisted contributions.
- [ ] I have [raised a PR against the documentation
repository](https://github.com/music-assistant/music-assistant.io/blob/main/CONTRIBUTING.md)
targeting the main or beta branch as appropriate.