chore: organize tooling and enable dependabot

[keys-i]

What changed

• enable weekly Cargo and GitHub Actions dependency updates
• place the movable Release-plz config under tools/config/
• place every helper shell script under tools/scripts/ and update all callers

Issue: not created; this is a bounded governance and path-only maintenance change.

Verification

• bash -n tools/scripts/*.sh
• bash tools/scripts/release.sh --self-test from outside the repository
• parsed the moved TOML and changed YAML files
• git diff --check
• required GitHub checks on this exact head

Review

• Public behavior and relevant docs are updated.
• No new runtime dependency or duplicated config/script remains.
• No unrelated files, generated output, secrets, or research clones are included.
• I will follow the Code of Conduct.

Risk: release automation now relies on its explicit custom config path. Roll back by reverting this commit.