fix(ci): gate Dependabot auto-merge on CI passing

[pnehrer]

Problem

The previous workflow used on: pull_request and called gh pr merge --auto --squash. Without branch protection rules requiring status checks, --auto resolves immediately — CI never has a chance to run before the merge lands.

Fix

Switch the trigger to on: workflow_run targeting the Rust CI workflow. The job only runs when that workflow completes with conclusion == 'success', so CI must pass before any merge is attempted.

The workflow_run event carries the head SHA of the triggering PR, which the step uses to look up the open PR and inspect the Dependabot commit message for update types.

Preserved behavior

The 0.x minor bump guard is kept intact: minor-version bumps where the previous version starts with 0. are excluded, consistent with Cargo's convention that a 0.x → 0.y change is potentially breaking.

[github-actions]

Line coverage:	18%
Lines covered:	729
Lines missed:	3,347
Total lines:	4,076