ci(dependabot): replace token merge with strict gate

[jrandolf]

Root cause: the pull-request workflow requests auto-merge using its own write-capable GITHUB_TOKEN before the exact-head tests, proto drift checks, packaging and security checks finish. That path can suppress post-merge push CI.

This replaces it with a read-only exact-head gate covering all seven original strict contexts and every applicable check. The install-only prebuilt job is structurally skipped on PRs and is the only permitted non-applicable skip. The repository's original GitHub CodeQL default setup is retained for Actions and Rust; a conflicting advanced workflow was removed. The original branch requirements remain and the gate will be added. Later auto-merge requests require a non-Actions credential and all checks/reviews green.

Local verification on 1ed29d3: hk check --all --slow, Rust 1.94.0 check and tests, cargo test --workspace and cargo test -p basic against isolated PostgreSQL 17.11 on the external Code drive, wasm32-wasip1 build, cargo package --locked, buf generate followed by cargo fmt --all and git diff --exit-code -- src, and actionlint all exited 0 on the final reruns. Initial tests without PostgreSQL failed with connection refused; an initial format-check approximation found generated formatting drift, which the exact CI formatting command resolved. Final logs and exit files: /Volumes/Code/Sources/.dev-storage/mathematic-inc-monitor/2026-09-24T2220Z-full-repair.PvYiXw/logs/sqlc-gen-sqlx-*.log and .exit; isolated database start/test/stop logs there too. Cross-platform prebuilt verification remains the responsibility of remote CI. No release or check waived.

CodeQL compatibility follow-up on exact head 83debb151c5d1039c9fe741e9f4bbff1f3e039c4: GitHub's original default setup has been restored rather than changing the required CodeQL provider/context. The re-run native hk check --all --slow exited 0; log and exit code: /Volumes/Code/Sources/.dev-storage/mathematic-inc-monitor/2026-09-24T2220Z-full-repair.PvYiXw/logs/sqlc-gen-sqlx-default-codeql-hk.log and .exit. The GitHub CodeQL validation run and strict PR-head checks are still pending; no merge is requested.