Dependabot doesn't handle pnpm catalogs correctly -- it resolves catalog: specifiers to concrete versions in the lockfile, causing frozen-lockfile failures in CI. This workflow detects Dependabot PRs that touch package.json or the lockfile, regenerates pnpm-lock.yaml, and commits the fix back to the PR branch.