fix(mergify): use rebase method for auto-update to avoid extra merge commits

[LalatenduMohanty]

Problem

The "Auto-update approved PRs that are behind" rule is creating merge commits (Merge branch 'main' into <branch>) instead of rebasing. This pollutes PR history with spurious commits from mergify[bot].

Examples:

• [proposal] Multiple cache wheel servers #1065 — 1 real commit + 2 Mergify merge commits
• feat(sbom): build purls with packageurl-python #1032 — 1 real commit + 2 Mergify merge commits

Root Cause

The update: action in .mergify.yml has no method specified, which defaults to merge.

Expected behavior:

If a rebase fails (e.g., conflicts), the update will fail cleanly rather than falling back to merge.

[LalatenduMohanty]

After investigating, the update action does not support a method: rebase parameter — it only accepts bot_account and always creates merge commits. So simply adding method: rebase to the existing rule won't work.

Background

• Commit 2b32364 originally added this rule using the rebase: action, which worked correctly (no merge commits).
• Commit 2547bb5 switched to update: because the Mergify rebase action is deprecated for fork PRs with bot_account after July 1, 2026. This introduced the merge commit problem.

Options

1. Use a merge queue with update_method: rebase — Supports rebase-based updates, but is a heavier workflow change and hits the same July 1, 2026 fork PR limitation.
2. Remove the auto-update rule entirely — Rely on the existing conflict notification rule and manual @mergify rebase comments.