fix(infra): make GitHub the honest authority

[forkwright]

Summary

• remove the Dependabot caller that cannot function in a non-Cargo repository
  under the shared Cargo-only verification contract
• make GitHub the authoritative repository, pull-request, review, CI, and merge
  surface in contributor guidance
• describe .kanon-ci.toml as a supplementary local Kanon recipe, not a live
  forge pipeline or independent merge verifier

Verification

No local build, test suite, or Kanon gate ran on Metis. git diff --check passed
on acb496e15591e1e6899a04b8cf44e543b4268ad9. This draft's public GitHub run is
the first exact-head execution of the active verifier.

Tracker and authority

• Refs fix(infra): adopt honest hybrid gate #70, whose merged caller and docs created the corrected surface.
• Refs Require the exact gate / gate context after stale PRs emit it #72 for the operator-owned eventual gate / gate branch-protection
  requirement. This PR does not mutate repository authority.
• Refs Make Dependabot auto-merge consume a typed verification profile .github#64 for a typed non-Cargo Dependabot verification
  profile.
• Refs Add a command-only runner profile to the hybrid gate .github#65 for a command-only hybrid-gate runner profile.

Collision inventory

• The branch is rooted at merged fix(infra): adopt honest hybrid gate #70 commit
  8b3fbe8b7c34355498a26f6870b6ac5235a29738 and does not reuse fix(infra): adopt honest hybrid gate #70's deleted
  head branch.
• PR fix(ci): name the sha's real version on every action pin #67's sole legacy-workflow comment change was re-verified as present in
  fix(infra): adopt honest hybrid gate #70's replacement workflow, then fix(ci): name the sha's real version on every action pin #67 was closed with the exact supersession
  evidence.
• Open PRs ci: adopt the fleet release-PR healer #65, docs: fix repo-tree and doc-list drift against docs/MANIFEST.toml #68, docs(design): define Zetesis acquisition boundary #69, and release PR chore(main): release 0.1.6 #71 do not change these three paths.

Honest residual

main currently has zero required status contexts. Issue #72 deliberately
sequences the operator-owned protection change after every surviving stale PR
emits the genuine gate / gate context on its current head.

Dependabot auto-merge remains absent in Dioptron until the shared reusable has a
real non-Cargo contract. No vacuous Cargo jobs substitute for that missing
mechanism.