Make Dependabot auto-merge consume a typed verification profile

[forkwright]

Finding

The shared Dependabot auto-merge reusable has one hard-coded Cargo verification
shape. It cannot represent a non-Cargo repository whose dependency surface is
GitHub Actions and whose real gate runs document or other command-only checks.

The caller has no typed way to select a different centrally governed check
contract. A non-Cargo consumer must therefore omit auto-merge, manufacture
vacuous Cargo checks, or fork the merge logic locally.

Evidence

At immutable .github commit
d49f2e27f8ce11005529f28effedbfd430891711:

• .github/workflows/dependabot-auto-merge.yml:7-8 exposes workflow_call
  with no inputs.
• .github/workflows/dependabot-auto-merge.yml:54 hard-codes four required
  groups: the terminal gate, Cargo deny, Cargo audit, and OSV.
• .github/workflows/dependabot-auto-merge.yml:103-121 waits until every group
  appears and fails when any never reports.
• .github/workflows/dependabot-auto-merge.yml:123-140 then requires every
  matching check to pass.
• Dioptron main@8b3fbe8b7c34355498a26f6870b6ac5235a29738 has no Cargo workspace.
  Its .github/workflows/gate-attestation.yml:35-58 supplies real Python and
  document checks to the hybrid gate instead of fake Cargo commands.

No open issue in this repository covers a typed non-Cargo verification profile.
Issues #17, #19, #61, and #63 concern scanner false-greens, publication
authority, docs-only change detection, and release-PR recovery respectively.

Why this matters

Auto-merge is safe only when the reusable knows which real verification
contract applies and refuses on missing evidence. A Cargo-only contract makes
safe centralization unavailable to non-Cargo consumers, while an arbitrary
caller-supplied list would let each consumer silently weaken the guard. The
current shape therefore pushes repositories toward either duplicated policy or
checks that exist only to satisfy a name.

Desired correction

Add a closed, validated verification profile or equivalent typed contract to
the reusable. Preserve the existing Cargo-security profile as the default, and
add a non-Cargo profile whose required groups are owned centrally rather than
provided as an unchecked free-form list. Reject unknown profiles before polling
or merging.

The non-Cargo profile must still require the genuine terminal gate and every
security group that the profile declares. It must never interpret absent Cargo
jobs as passing and must never invite consumers to add vacuous jobs.

Done when:

• the reusable validates a closed set of verification profiles;
• fixtures prove the Cargo profile still refuses missing Cargo security groups;
• fixtures prove the non-Cargo profile merges only after its real groups appear
  and pass, and refuses missing, pending, failed, or cancelled groups;
• a non-Cargo consumer such as Dioptron adopts the reusable without synthetic
  Cargo jobs; and
• the consumer run records the selected profile and exact checks used for the
  merge decision.