Fix push-to-pull-request-branch target for workflow_dispatch

The codegen-agentic-fix workflow is always triggered via
workflow_dispatch (from codegen-check.yml), which has no PR context.
The push-to-pull-request-branch safe-output defaulted to target
"triggering", causing every run to fail with "requires pull request
context".

Set target: "*" with labels: [dependencies] so the agent can push to
the PR branch identified by the pr_number input, constrained to PRs
carrying the "dependencies" label (Dependabot PRs).

Author: edburns

.github/workflows/codegen-agentic-fix.lock.yml

@@ -34,6 +34,8 @@ tools:
 
 safe-outputs:
   push-to-pull-request-branch:
+    target: "*"
+    labels: [dependencies]
   add-comment:
     target: "*"
     max: 5