chore(ci): add Dependabot so the SHA-pinned actions get bumped

[scttfrdmn]

Closes #485. Companion to spore-host/libs#33 (merged, 0e1124b), which found
this gap: no spore.host tool repo had a Dependabot config — only the umbrella.

Why

Every action in this repo is pinned to a commit SHA. That closes the mutable-tag
hole but opens a staleness one: a SHA never moves, including past a security
fix, and unlike @v6 nothing updates it for you. Pinning is only safe if
something bumps the pins. Nothing did.

Not theoretical: actions/checkout@v6 moved from df4cb1c (2026-06-02) to
d23441a (2026-07-16) and this repo still pinned df4cb1c. The umbrella, which
has Dependabot, has since moved on to checkout@v7 / setup-go@v7.0.0.

This bites hardest in release.yaml, which pins the release-signing actions —
goreleaser-action, cosign-installer, attest-build-provenance (the #344
supply-chain work). A frozen cosign-installer means releases keep getting signed
by an old cosign, and cosign 3.x already changed its CLI surface. Those are the
last actions that should silently freeze.

What

Weekly (Mon 09:00 PT), grouped into one PR, cooldown: default-days: 7 so a
freshly-published tag isn't proposed the day it ships.

Three deliberate departures from the umbrella's config, each based on what its
Dependabot PRs actually did rather than what the config claims:

• Actions group pattern *, not actions/*. The signing actions —
  goreleaser/, sigstore/, aquasecurity/, codecov/ — aren't under
  actions/. Under actions/* each falls outside the group and opens its own
  PR, which is how updates get ignored.
• No reviewers: key. Deprecated and inert: all 12 of the umbrella's
  Dependabot PRs request a reviewer via it and not one has ever had a review
  request. CODEOWNERS is the working mechanism.
• Labels created first (dependencies, type:infra, type:security). This
  repo had none of them. Dependabot silently drops labels it can't apply rather
  than erroring — the umbrella asks for dependencies, has no such label, and all
  its PRs landed with only type:infra. A config naming a missing label looks
  fine and half-works.

The `gomod` entry lists all 12 modules — root plus every `lambda/*`, each
pinning its own deps behind a `replace ../..`. A single `/` entry would leave
eleven unmanaged. Verified the list matches the tree exactly (12 config dirs, 12
real modules, no phantoms).

Tests

Two new assertions in the existing ci_gates_test.go:

• TestDependabotCoversEveryAction — every action in every workflow must be
  matched by some group pattern.
• TestDependabotCoversEveryGoModule — every go.mod must be watched, and
  every watched directory must contain one (a phantom directory makes Dependabot
  error every run, which trains you to ignore it).

Mutation-tested; all five fail as intended:

Mutation	Caught
actions pattern * → actions/*	✅ names trivy / configure-aws-credentials
drop one module from directories:	✅ names the module
collapse directories: to a single /	✅
add a directory with no go.mod	✅
remove the gomod entry	✅

One interaction worth knowing: Dependabot rewrites the trailing # vX.Y.Z comment
along with the SHA, sometimes as a bare major (# v7, seen in #484).
That still satisfies the pinning gate's v?\d regex, so its own bumps won't fail
it.

make check-fmt / gofmt clean, go vet ./... clean, full go test ./... green.
CI-only — no change to the tool.