ci: Friday release train (L0)

[vreshch]

What

Adds a fully automated Friday MINOR release train for @agentage/memory-core, ported from the proven find-mcp pattern and simplified for this Level 0 package (no internal @agentage deps, npm-only surface, no MCP registry / server.json).

release-train.yml

Runs weekly and cuts a release with no human step on the happy path:

1. Prague gate - DST-proof. Two crons (0 18 * * 5 and 0 19 * * 5) cover both offsets; the gate job keeps only the run where the local Prague hour is 20, so the train always fires at 20:00 Europe/Prague regardless of DST.
2. Dependabot quiescence - wait-only. Polls for open dependabot PRs and delays the train while the org triage automation may still be working. It never merges dependabot PRs itself (that is owned by org automation); PRs still open after the wait are left behind and the train departs without them.
3. Release - guards against a stuck open release/* PR, detects releasable commits since the last tag (docs/ci/plain-chore excluded, chore(deps) counts), always does a minor bump of package.json (+ lockfile via npm install --package-lock-only), runs npm run verify, opens the chore(release): X.Y.Z PR, and auto-merges it (squash).
4. Dispatch publish - explicitly runs publish.yml.

Why the explicit publish dispatch (GITHUB_TOKEN rationale)

A merge performed with the default GITHUB_TOKEN does not trigger other workflows, so publish.yml's push trigger never fires from the auto-merge. The train therefore dispatches publish.yml explicitly after merging, which requires permissions: actions: write on this workflow. publish.yml already treats workflow_dispatch as a release and its release-gate regex already accepts chore(release): X.Y.Z, so no change was needed there.

dependabot.yml

Removed the nonstandard ignore (semver-major) rule to match the org standard - all updates, including majors, come through grouped. Schedule, assignees, group, and PR limits already matched.

Friday 20:00 Prague slot

Deliberately after the dependabot Friday 18:00 Europe/Prague run, giving triage a window to land the weekly dependency bundle before the train departs.

Verification

npm ci + npm run verify pass locally (165 tests). All workflow + dependabot YAML validated with yaml.safe_load.