fix(ci): gate Dependabot auto-merge on CI passing

[pnehrer]

Problem

The existing workflow uses on: pull_request and gh pr merge --auto --squash.
Without branch protection rules, --auto merges immediately rather than
waiting for CI to pass — Dependabot PRs were being squash-merged the moment
the workflow ran, before Rust CI had a chance to complete (or even start).

Fix

Switch the trigger to on: workflow_run targeting Rust CI. The job runs
only when the CI workflow completes successfully and the triggering event
was a pull_request from dependabot[bot]. The merge step is still gated by
the existing patch/minor semver check (no major bumps).

Key differences from the old approach:

	Before	After
Trigger	pull_request	workflow_run (after Rust CI completes)
CI gate	None (merged immediately)	conclusion == 'success' required
Actor check	github.actor == 'dependabot[bot]' in if:	workflow_run.actor.login == 'dependabot[bot]'
PR lookup	Direct (github.event.pull_request)	Resolved from head_sha via API
Semver scope	patch + minor	patch + minor (unchanged)

[github-actions]

Line coverage:	85%
Lines covered:	86
Lines missed:	15
Total lines:	101