docs: record dependency graph and Dependabot settings

[CoderDeltaLAN]

Records manual GitHub Advanced Security UI evidence for dependency graph and Dependabot-related settings after the v0.3.0 hardening train.

Scope:

• Add a dedicated dependency graph and Dependabot settings record.
• Update the supply-chain evaluation document so it no longer carries stale private vulnerability reporting wording.
• Document deferred boundaries for Dependabot version updates and automatic dependency submission.

Out of scope:

• No .github/dependabot.yml.
• No Dependabot version updates.
• No release, tag, PyPI, branch protection, CI, or runtime behavior changes.
• No claim that malware alerts or grouped security updates are enabled unless later verified by UI evidence.

Local verification completed before push:

• ./scripts/check.sh passed.
• 142 unit tests passed.
• ruff passed.
• text hygiene passed.
• git whitespace checks passed.
• staged content guards passed.
• safety scan found no obvious secret patterns.