CI upkeep: align and bump action pins, pin uv and the docs toolchain, add job timeouts, Dependabot #377

Routine CI upkeep for the October 2026 pass over .github/workflows, .github/dependabot.yml (new) and .pre-commit-config.yaml.

Findings: release-python-packages.yml and deploy-python-docs.yml still use actions/checkout v7.0.0 and actions/setup-python v6.3.0 while the other workflows use v7.0.1 and v7.0.0. The pypa/gh-action-pypi-publish comment says release/v1 but the pinned SHA is v1.13.0 (latest is v1.14.2). Patch releases are out for actions/setup-java (v6.1.0), actions/upload-artifact (v7.0.2), actions/download-artifact (v8.0.2) and zgosalvez/github-actions-ensure-sha-pinned-actions (v5.0.10), and black has 26.10.1. Three astral.sh/uv/install.sh installs float (two test jobs and the docs deploy), while dependency-floors pins 0.12.0 on purpose. deploy-python-docs.yml installs unpinned mkdocs packages, so the deployed site can differ from what docs-build.yml checked. No test job has a timeout-minutes, so a job that never gets a runner would hold the 360-minute default.

Plan: align and bump the SHAs, pin the uv installs and the docs toolchain, add job timeouts from recent successful run durations, add a grouped weekly Dependabot config for github-actions, bump black, move ubuntu-latest to ubuntu-24.04, skip the heavy test jobs on draft pull requests (with ready_for_review starting them), and add a pull-request-only concurrency group to lint-workflows.yml.