ci(release): consolidate unattended multi-package releases

[jgeluk]

Summary

Remove the parallel dependency-triggered version/publish workflow. Main CI becomes the sole release path, using legra-ai/github-actions#12.

• Prepare one signed version revision and use it throughout Rust, npm and Python validation, platform artifact builds and publication.
• Gate tags and draft releases on all validation and builds; mark a release published only after crates.io, npm and PyPI publication succeeds.
• Resume incomplete releases from their original source revision instead of assigning another version or silently accepting a conflicting crate.
• Replace three conflicting Dependabot approval/merge workflows with one trusted completion handler that merges only the exact head that passed full CI.
• Cover Cargo, npm, uv and Actions updates daily, including grouped security updates.
• Dispatch main CI explicitly after bot merges and schedule daily recovery runs.
• Pin the formatter consistently in CI and local commands; the first PR run exposed floating-nightly comment-format drift on otherwise green source.
• Replace obsolete release instructions and run release-workflow contract regressions in CI.

Existing registry credentials, PyPI environment and platform build matrix are preserved. Legacy shared workflows remain unchanged for other repositories.

Validation

• Actionlint passes for the modified release pipeline and new Dependabot workflow.
• Parsed Dependabot configuration verifies daily coverage of all four ecosystems.
• Shared release actions pass 22 Python tests and 7 Node tests in CI.
• The PR's existing Rust/npm/Python matrix will validate the checked-out PR revision before merge.
• All Rust/npm/Python jobs passed on the first run; its lone formatting failure is addressed by the shared formatter pin. Five local workflow contract tests pass.

Rollout blocker

The complete rerun passed: https://github.com/legra-ai/dotenvage/actions/runs/33965321766.

Merge is blocked by the existing classic main-branch protection: one approving code-owner review is required. This also prevents unattended Dependabot merging and the generated version commit with the current GITHUB_TOKEN-only setup. Do not merge this as an operational unattended-release solution until repository policy is explicitly resolved. A narrowly scoped release GitHub App can preserve human review for ordinary changes; alternatively, the owner can authorize replacing the human gate with automated gates. No protections have been bypassed or weakened.