ci(deps): group, throttle and auto-merge Dependabot updates

[WhiteMuush]

Dependabot was opening about three pull requests every week: the npm production and development groups, plus one per GitHub Action since that ecosystem had no groups block at all.

Dependabot

• Regroup npm by semver impact instead of prod/dev (npm-patch / npm-risky), so patches can flow unattended while minors and majors are held for review ahead of a release tag.
• Group the github-actions ecosystem, which was ungrouped and drip-fed one PR per action.
• Add the docker ecosystem, missing entirely, which left the node:22-bookworm-slim base image unwatched.
• Groups default to applies-to: version-updates, so a single advisory touching several packages still opened one PR per package, bypassing both the schedule and the open PR limit. Each ecosystem now carries a mirrored security-updates group.
• Add a 7 day cooldown so no release is adopted inside the window where a compromised package is usually caught and yanked. Cooldown covers version updates only and never delays a security fix.
• Pin commit-message.prefix, which Dependabot had been inferring from history (22 build(deps) vs 8 chore(deps)).

Net effect: roughly 3 PRs per week down to 3 per month, and a multi-package advisory now lands as one PR instead of N.

Auto-merge

dependabot-automerge.yml enables auto-merge on patch bumps only. Two independent gates guard it: the cooldown means the release is at least 7 days old, and --auto holds the merge until the required ci check passes. That check aggregates quality, test, build, integration and e2e.

Requires allow_auto_merge to be enabled on the repository, otherwise the merge step fails.

CI on develop

The four workflows were scoped to branches: [main], so develop had no CI coverage at all and every regression was deferred to a 60 commit promotion diff. They now run on develop too.

Since pull_request workflows execute from the version of the file carried by the PR, this PR exercises its own new triggers.

Expect legitimate failures: this is the first time the suite runs against develop code.