ci: cut redundant Actions runs, add required-check gate job

[JustMaris]

Summary

• Gate auto-merge.yml on the dependabot[bot] actor.
• ci.yml: drop the redundant push:branches:[main] trigger (pull_request is unrestricted, so PR coverage is unchanged).
• security.yml: drop push:branches:[main], add a weekly schedule. No path filter — no npm/pip manifest exists here, so every PR still gets scanned.
• dependabot.yml: weekly → monthly.
• Add a required-checks-passed job.