Prevent duplicate Dependabot release-train work

[Copilot]

Duplicate release-train runs opened equivalent yaml update PRs hours apart. This change adds repository-level cooldown, stable work identity, and guarded stale-issue cleanup.

• Dispatch deduplication

  • Enforce a seven-day cooldown for routine repository work.
  • Recheck open issues and PRs before dispatch.
  • Persist a bounded dispatch ledger with fail-closed fallback behavior.

• Stable work identity

  • Derive a canonical SHA-256 identity from repository, ecosystem, dependencies, manifests, and target version.
  • Use deterministic, Git-safe branch names without recreating existing refs.

  <!-- smart-dependabot:identity=<sha256> -->
  dependabot-agent/<ecosystem>-<12-character-digest>
  

• Existing-work visibility

  • Admit only known automation identities through the integrity guard.
  • Continue treating all bot-authored content as untrusted data.

• Stale issue lifecycle

  • Replace unconditional expiry with a guarded safe-output job.
  • Close only workflow-owned issues older than 14 days with no developer comments, reactions, assignments, edits, or linked work.
  • Fail closed when ownership or interaction history is incomplete.

• Package contracts

  • Update Dependabot documentation, package-authoring guidance, contract coverage, and generated workflow locks.