Group dependabot updates natively, drop Combine PRs workflow

[xhan97]

Replaces the Combine PRs workflow with dependabot's native grouped updates.

Why

.github/dependabot.yml had no groups:, so every dependency got its own PR and the Combine PRs workflow stitched them back together downstream. Dependabot has supported grouped updates natively since 2023 — it opens one combined PR per group upstream, with no extra workflow involved.

The workflow was also broken. It had failed on every run since 2026-03-25 — 20 consecutive failures:

HttpError: Resource not accessible by integration
- .../rest/git/refs#create-a-reference
Failed to create combined branch

It needs contents: write to create the combined branch. The repo already grants that (default_workflow_permissions: write, no rulesets), so the cap is almost certainly an organization-level Actions policy. Nothing surfaced the failure, so dependabot PRs quietly accumulated to 10 (cleared in #44).

Grouping needs no workflow, no token, and no elevated permissions, so this failure mode goes away rather than needing an org settings change.

Grouping

• python-runtime — production deps (numba, numpy, pandas, scikit-learn, tqdm)
• python-dev — dev/docs/lint deps
• github-actions — all actions

Runtime and dev are deliberately separate: bumps to numpy/scikit-learn/numba affect library consumers and deserve their own review, while docs and lint bumps are low-risk. It also limits blast radius — a grouped PR is all-or-nothing, so one bad bump blocks its whole group. That is not hypothetical: notebook 7.5.7 broke the docs build in #41 and would have held up every docs dependency with it. If a package gets stuck long-term, give it its own group or an ignore entry.

Expect ~3 PRs per week instead of ~10 individual ones.

Also drops the uv schedule from daily to weekly; daily PRs add little once updates are grouped.