Enable event-driven Dependabot auto-merge

[qqrm]

Summary

Switch Dependabot auto-merge from schedule-only polling to event-driven retries so eligible dependency bump PRs are queued for auto-merge as soon as they appear and after trusted checks finish.

Problem

The existing auto-merge workflow only ran on schedule and workflow_dispatch. In practice that left green Dependabot PRs waiting for the next cron tick, and GitHub's scheduled workflow timing is not precise enough to give fast merges.

Solution

Trigger the auto-merge workflow on pull_request_target for Dependabot PR metadata changes and on successful trusted workflow_run completions for the CI, actionlint, typos, and zizmor workflows. Keep the existing merge policy for cargo updates and non-major GitHub Actions bumps, and keep the workflow metadata-only with documented zizmor suppressions instead of checking out or executing PR code.

Scope

Included: .github/workflows/auto_merge.yml trigger and selection logic updates.
Not included: changes to branch protection, Dependabot schedules, or release automation.

Validation

• actionlint -color
• zizmor --min-severity medium .
• cargo +nightly fmt --check
• cargo +nightly clippy --all-targets --all-features -- -D warnings
• cargo +nightly build --features debug-tracing
• cargo +nightly test --locked

Risks

This still relies on privileged GitHub Actions triggers (pull_request_target and workflow_run) because normal pull_request runs cannot merge Dependabot PRs. The workflow remains metadata-only and does not check out or execute PR contents, but reviewers should still look closely at any future edits to this workflow.