chore: remove deprecated dependency cooldown workflows after migrations

[j7an]

Goal

Remove the deprecated cooldown workflows after sibling repos have migrated to native Dependabot cooldown plus the new dependency safety workflow.

Background

Once repos rely on native Dependabot cooldown.default-days: 5, the reusable workflows should no longer need a pending cooldown gate or scheduled rescan. The old pair:

• .github/workflows/dependency-cooldown.yml
• .github/workflows/cooldown-rescan.yml

exists to implement workflow-side waiting. That model is being replaced by native PR-creation cooldown and safety verification.

Preconditions

Do not start this cleanup until all sibling repos that used the legacy cooldown workflows have migrated:

• j7an/dep-rank
• j7an/nexus-mcp
• j7an/cross-agent-reviews

Each repo should:

• use native Dependabot cooldown.default-days: 5 in relevant updates blocks,
• call the new dependency-safety.yml reusable workflow,
• no longer call dependency-cooldown.yml,
• no longer call cooldown-rescan.yml.

Scope

• Remove .github/workflows/dependency-cooldown.yml.
• Remove .github/workflows/cooldown-rescan.yml.
• Remove tests and fixtures that only support deprecated pending cooldown/rescan behavior.
• Keep reusable dependency extraction and release-age verification primitives if still used by dependency-safety.yml.
• Update README to remove legacy cooldown setup instructions.
• Update any internal CI workflow that dogfoods the old cooldown workflow.

Acceptance Criteria

• No sibling repo references dependency-cooldown.yml or cooldown-rescan.yml.
• shared-workflows no longer publishes the deprecated cooldown workflows.
• CI passes after removing obsolete workflow tests/docs.
• README only documents the native-cooldown plus dependency-safety model.
• Release notes call out this as a breaking cleanup if workflow consumers pinned floating tags.