docs: verify Dependabot settings evidence

[CoderDeltaLAN]

Summary

• Verify Dependabot settings evidence with terminal/API probes and limited UI evidence where no API field was found.
• Document malware alerts and grouped security updates as enabled repository-maintenance signals.
• Keep Dependabot version updates disabled / not configured because no .github/dependabot.yml exists.
• Extend post-release audit guards for these public-truth records.

Checks

• Local checks passed: 142 tests, Ruff, text hygiene, git whitespace.
• Post-release audit passed after commit.
• Pre-push guard passed for 37c74abf461b2d8ec91973a23f68dec71bde3c93.

Boundaries

• Documentation and audit-guard change only.
• No .github/dependabot.yml added.
• No runtime code, release, PyPI, branch protection, or workflow behavior changes.