ci: dependabot + upstream watch for the pinned mermaid-rs-renderer (and all ecosystems)

[hartsock]

Problem

Scrybe's diagram fidelity now depends on a third-party crate pinned at mermaid-rs-renderer = "0.3.1" (workspace Cargo.toml), but nothing watches upstream:

• .github/dependabot.yml does not exist at all — no automated bump PRs for any ecosystem (cargo, npm, pip, github-actions).
• No issue or doc defines a bump cadence or procedure for the renderer pin.
• mermaid-render: conformance: gen_oracle.sh --with-upstream + upstream fixtures Tier 1 #83 supplies the gate (golden-snapshot diffs on bump) but not the trigger — without a watcher, upstream security or fidelity fixes arrive never.

Scope

• Add .github/dependabot.yml covering at minimum the cargo ecosystem (weekly), plus github-actions, npm (scrybe-app), and pip if cheap.
• Group or clearly label the mermaid-rs-renderer bump so its PR is recognizable; the review mechanism for it is mermaid-render: conformance: gen_oracle.sh --with-upstream + upstream fixtures Tier 1 #83's snapshots (until mermaid-render: conformance: gen_oracle.sh --with-upstream + upstream fixtures Tier 1 #83 lands, bumps get manual visual review — note this in the PR template or dependabot config comment).
• Per workspace policy: "Dependabot branches are patches, not projections. Merge them promptly."

Acceptance

Dependabot opens PRs for outdated cargo deps; a mermaid-rs-renderer bump PR is distinguishable at a glance and references the snapshot-gate expectation.

Filed from the 2026-07-29 backlog scrub — the adoption (#132/#37) created this obligation; blocks nothing but unblocks safe upgrades. Pairs with #83.