Fix: contain Dependabot PR fan-out

[hyperpolymath]

What changed

• Consolidates eleven Cargo update blocks into one directories: block.
• Groups the same dependency across fleet crates with group-by: dependency-name.
• Reduces the Cargo version-PR ceiling from 55 to 3.
• Makes both Dependabot fixer scripts generate bounded, grouped configurations.
• Makes the coverage fixer consolidate directories and refuse already-duplicated ecosystems instead of appending more blocks.

Root cause

Dependabot applies its open-PR limit per update block. Eleven Cargo blocks using the default limit of five admitted 55 simultaneous PRs. The coverage fixer could reproduce the same N×5 shape.

Validation

• Fixture tests for creation, consolidation, idempotency, and duplicate refusal
• bash -n
• yq eval
• git diff --check
• ShellCheck (only two pre-existing warnings: dynamic source and required-but-unused finding JSON)