Misc cleanup: bump auto-assign action, autoprefixer/postcss-cli, stop tracking generated cli-docs

[rossigee]

Summary

Split out from #731 per review feedback, as the lowest-risk, independent piece. This does not depend on the other two split-out PRs.

• Bump kentaro-m/auto-assign-action v1.2.4 -> v2.1.2
• Bump autoprefixer 9.7.4 -> 10.5.2 and postcss-cli 7.1.2 -> 11.0.1 (fixes the picomatch ReDoS npm audit advisory)
• content/cli-docs/ is regenerated on every build by cli-docs.sh but was committed to git, causing spurious diffs each run. Added to .gitignore and untracked the 109 already-committed files.

Related

Part of the Hugo/Bulma upgrade work originally proposed in #731, split into independently reviewable pieces per @OrlinVasilev's request there. See also the other two parts:

• Hugo 0.163.3 + Bulma 1.0.4/Dart Sass migration (to follow)
• Playwright E2E suite + CI workflow (to follow, depends on the above)

Test plan

• npm audit reports 0 vulnerabilities after the bump
• postcss-cli 11 + autoprefixer 10 verified to process CSS correctly (existing postcss.config.js unchanged)

[Vad1mo]

The content/cli-docs/ untracking is correct and I verified it end to end: cli-docs.sh is invoked from load-docs.sh:65, which is make prepare, which both production-build and preview-build depend on. The tracked files were already being overwritten by rsync --delete on every deploy, so published output does not change. Good cleanup.

Two blocking items:

1. kentaro-m/auto-assign-action@v2.1.2 does not exist. The latest tag on that repo is v2.0.2; action.yml 404s at v2.1.2. Merging this breaks the Auto Assign workflow for every PR after it. This is not caught by CI because the workflow runs on pull_request_target, so the green add-reviews check here executed the base branch's v1.2.4, not your change. Please use v2.0.2, and preferably pin to the full commit SHA with a # v2.0.2 comment, since this workflow runs with base-repo write permissions.

2. postcss-cli@11.0.1 declares engines: {"node": ">=18"}, but .nvmrc on main is v14.11.0 and this PR does not change it. The Node bump lives in #745, so this PR is not independent as described. Either add the .nvmrc bump here or drop the postcss-cli bump.

Also note this overlaps entirely with dependabot #756, which bumps the same packages to the same versions and has the same Node constraint. Worth deciding which one carries the dependency change so the other can drop it.