ci(deps): retire root npm from Dependabot, add native bun update (ARC-304)

[soydachi]

What / Why — ARC-304 (follow-up of ARC-297)

Dependabot's npm updater bumps package.json but cannot regenerate bun's
bun.lock (bun's lockfile is unsupported). Every root npm Dependabot PR
therefore left the lockfile stale and CI failed with:

error: lockfile had changes, but lockfile is frozen

bun install --frozen-lockfile runs in both ci.yml (Test) and security.yml
(Dependency audit), so those PRs could never go green.

Decision — Option 2 (native, no elevated auto-commit)

Chosen over Option 1 (auto-commit onto Dependabot's own branches) because it is
strictly safer: no untrusted PR-head checkout, no write token exposed to a
third-party dependency's install scripts, no pull_request_target.

This PR:

1. Removes the ROOT npm ecosystem from .github/dependabot.yml
   (keeps github-actions; claudeline also keeps the real-npm /docs/remotion).
2. Adds .github/workflows/deps-bun-update.yml — a scheduled + on-demand
   job that runs bun update, regenerates bun.lock in the same commit,
   and opens its own PR (green under --frozen-lockfile).

Why CVE coverage is NOT lost

• Dependabot security updates are disabled on this repo, so removing the
  version-update stanza leaves no orphaned security PRs.
• bun audit + OSV scan already run as required checks on every PR/push and
  on the weekly Security cron — CVE detection is unchanged. The native
  workflow (weekly + workflow_dispatch) provides remediation.

⚠️ Gated prerequisites before this can open a green PR (human + secret-seal)

The workflow uses a scoped GitHub App token so the auto-PR triggers CI
(PRs opened with the default GITHUB_TOKEN do not trigger workflows).
Before/at merge, a human must:

1. Install the org GitHub App on this repo with contents: write +
   pull_requests: write.
2. Seal DEPS_BOT_APP_ID + DEPS_BOT_APP_PRIVATE_KEY as Actions secrets
   (gate humano — secret-seal; CSO visibility on token scope).

Until then the mint step fails fast and no PR is opened (harmless). After the
secrets exist, run the "Deps — bun update" workflow via workflow_dispatch
to produce the green proof PR.

proposer ≠ executor, reviewer ≠ builder: authored by it-admin; merge is
the human gate and must be a separate identity.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud