Track Dependabot updates for WTA Rust dependencies

[vanzue]

Description of the new feature

WTA statically links a growing Rust dependency graph, but the repository currently has no automated version-update configuration for tools/wta/Cargo.toml and tools/wta/Cargo.lock. This makes routine dependency maintenance manual and increases the chance that reliability fixes and security updates are discovered late.

Configure GitHub Dependabot to monitor the WTA Cargo dependency graph and raise reviewable pull requests. The intent is to automate discovery and proposal of updates, not to auto-merge untested dependency changes.

Tracking implementation: #520

Proposed technical implementation details

Initial scope:

• Add .github/dependabot.yml for the Cargo ecosystem under /tools/wta.
• Run weekly on Monday at 09:00 Asia/Shanghai.
• Group routine minor and patch updates to reduce PR noise.
• Exclude agent-client-protocol* from that group so ACP SDK changes receive dedicated compatibility review.
• Limit concurrent Dependabot PRs to five.
• Continue relying on the existing WTA build and test pipeline before merge.

WTA-specific maintenance requirement:

• Cargo graph changes must regenerate tools/wta/cgmanifest.json and the generated WTA block in NOTICE.md with build/scripts/Generate-WtaThirdPartyNotices.ps1.
• Dependabot does not run that repository-specific generator itself. The generated files therefore need to be refreshed by a maintainer before an update PR is merged; a future CI drift check or trusted follow-up workflow can automate enforcement.

Out of scope for the initial PR:

• Automatic merging of Dependabot PRs.
• Updating Claude or Codex ACP adapter versions embedded as command strings; Cargo Dependabot cannot discover those npm package references.
• Migrating to Renovate or adding a privileged workflow that writes to Dependabot branches.
• Changing repository-level Dependabot security-update settings, which requires administrator access.

Acceptance criteria:

• Configure Dependabot for WTA Rust dependencies #520 is merged and Dependabot recognizes /tools/wta on the default branch.
• A manual Insights → Dependency graph → Dependabot → Check for updates run completes successfully.
• Routine compatible updates are grouped, while ACP SDK updates appear separately.
• The first generated update PR passes WTA validation after third-party attribution files are refreshed.
• The team evaluates whether a CI drift check should enforce generated attribution updates.