fix(repo): let dependency updates clear the DCO and title gates

[justinmerrell]

Closes the two stuck Dependabot pull requests, #60 and #61, by fixing what
actually rejected them — which was not the dependency in either case. Lint,
Schema, Site Build and the whole Dev Container workflow pass on both.

The DCO check rejected a sign-off that was there

Dependabot signs its commits. It authors them as one identity and signs them as
another:

author:  dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
trailer: Signed-off-by: dependabot[bot] <support@github.com>

dco.yml matched the trailer against %an <%ae> exactly, so the address failed
it. Signed off is a required check, so this left every dependency update
mergeable only by spending the OrganizationAdmin bypass — the habit ADR 0015
was written to end, recreated for a class of change nobody would think to look
at.

A GitHub App's sign-off is now matched on name, and only when both halves
of the author identity say bot (%an ends [bot] and %ae ends
[bot]@users.noreply.github.com). Verified against the real commits on #60 and
#61, and against five negatives — an unsigned human, a human signing under a
different address, a bot name with a human address, a bot signing under someone
else's name, all still rejected.

The title check rejected a prefix the config could never have got right

dependabot.yml set prefix: 'devcontainer'. Dependabot emits the prefix as
the type, and devcontainer is a scope. Every dev container update
since that line was written opened with a title no gate would accept, and
nothing said why: check:commits reconciled three copies of the vocabulary and
dependabot.yml was a fourth it never read.

Prefixes become build(deps), build(deps-dev) and ci(deps) — the vocabulary
this repository already used in build(deps): bump the tooling group, dropping ajv-formats — and check:commits now reads dependabot.yml and
CONTRIBUTING.md too. The check found the drift on its first run:
CONTRIBUTING.md was missing deps-dev.

The capitalised subject (Bump …) is not configurable — dependabot-core decides
it from a heuristic over recent commits. dependabot-title.yml lowercases it
rather than exempting the bot, so the rule stays single and nothing lands on
main reading Bump.

Also

wrangler leaves the tooling group. GOVERNANCE.md names it as the only
dependency here handed a credential and rests its guarantee on that pin moving
"through a diff someone opened deliberately"; inside the group it would move in
four other packages' lockfile churn.

Rationale in ADR 0016.

Next

Once this is on main, @dependabot recreate on #60 and #61 brings them back
correctly prefixed and green — merging on CI alone, with no bypass.

Checklist

• Commits are DCO signed off (git commit -s)
• Commit messages are Conventional and correctly scoped
• task ci:lint, task check:types, task check:test pass locally
• No specification prose, schema, or conformance fixture is touched