Standardize CI and Dependabot baseline for Wave 2

[bernalde]

Goal

Standardize this repository's CI and Dependabot baseline as part of the JuliaQUBO Wave 2 solver-wrapper infrastructure pass.

Coordination Links

• Umbrella: Umbrella: Standardize JuliaQUBO package CI and repository rules QUBO.jl#53
• Wave 2 tracker: Wave 2: Standardize solver-wrapper CI and Dependabot baseline QUBO.jl#55

Baseline

• Use a CI workflow for package tests.
• Keep Julia 1.10 and 1 on ubuntu-latest.
• Keep Julia 1 on windows-latest.
• Keep Julia 1.10 on Windows where already required or where this repo already pays that CI cost.
• Use julia-actions/cache consistently unless this repo has a concrete reason not to.
• Keep Dependabot for julia and github-actions.
• Prefer weekly Julia dependency checks and monthly GitHub Actions updates.

Allowed Exceptions

• External binary/build setup may remain repo-specific where needed.
• Hardware/API smoke workflows remain optional and non-blocking.
• Scheduled dependency drift checks remain optional and non-blocking.
• Do not add label automation unless this repo already has it and it is working.
• Branch-protection edits are deferred to Wave 3 unless required to unblock this repo's implementation PR.

Acceptance Criteria

• A PR is opened in this repository if changes are needed.
• PR CI is green before merge.
• Post-merge main CI is green after merge.
• Optional hardware/API/scheduled checks are preserved but are not required branch-protection gates.
• Remaining drift is either eliminated or listed as an explicit exception in the PR summary.
• This issue is linked from the Wave 2 tracker.

Non-goals

• No package release.
• No Julia API changes.
• No registry changes.
• No centralized reusable workflow migration in this pass.

[bernalde]

No PR opened: origin/main already satisfies the Wave 2 CI and Dependabot baseline.

Verified against origin/main at 5664fcd2b943343ee9fad2aa7fd93d0b1743b468:

• Package workflow is named CI.
• CI keeps Julia 1.10 and 1 on ubuntu-latest.
• CI keeps Julia 1 on windows-latest; no Julia 1.10 Windows leg is added because this repository was not already paying that CI cost.
• CI uses julia-actions/cache@v3.
• The repo-specific native C ABI smoke step is preserved as allowed external binary/build setup.
• Dependabot covers julia weekly and github-actions monthly.
• The Wave 2 tracker already links this issue.
• Latest main CI run passed: https://github.com/JuliaQUBO/MQLib.jl/actions/runs/28528547283

Remaining drift: none identified for this Wave 2 baseline.