ci: Dependabot cooldown + accept residual zizmor notes (#136)

Clears the remaining zizmor code-scanning findings on this repo.

**Fixed**
- `dependabot-cooldown` (5): a 7-day cooldown on every update ecosystem
  (cargo, npm, pip, ci-pip, github-actions) so Dependabot waits a week after a
  release before opening the bump PR.

**Accepted via `.github/zizmor.yml`** (no workflow code changed)
- `template-injection` (sync-about.yml): false positive — every expansion is the
  internal `grep -c` indicator count, not attacker-controllable.
- `use-trusted-publishing` (release.yml): OIDC migration tracked separately.
- `superfluous-actions` (release.yml): `softprops/action-gh-release` kept deliberately.

Verified with zizmor 1.25.2: 0 findings.

.github/dependabot.yml

@@ -6,6 +6,8 @@ updates:
     schedule:
       interval: weekly
     open-pull-requests-limit: 10
+    cooldown:
+      default-days: 7
     commit-message:
       prefix: "deps(cargo)"
 
@@ -15,6 +17,8 @@ updates:
     schedule:
       interval: weekly
     open-pull-requests-limit: 10
+    cooldown:
+      default-days: 7
     commit-message:
       prefix: "deps(npm)"
 
@@ -24,6 +28,8 @@ updates:
     schedule:
       interval: weekly
     open-pull-requests-limit: 10
+    cooldown:
+      default-days: 7
     commit-message:
       prefix: "deps(pip)"
 
@@ -37,6 +43,8 @@ updates:
     schedule:
       interval: weekly
     open-pull-requests-limit: 10
+    cooldown:
+      default-days: 7
     commit-message:
       prefix: "deps(ci-pip)"
 
@@ -47,5 +55,7 @@ updates:
     schedule:
       interval: weekly
     open-pull-requests-limit: 10
+    cooldown:
+      default-days: 7
     commit-message:
       prefix: "deps(actions)"