Harden GitHub automation and diagnostics

[azurras]

Summary

• cache Gradle state in CI while keeping pull-request caches read-only
• retain Java, JavaScript, and Gradle diagnostics for failed matrix jobs
• publish browser-test JUnit XML without losing console output
• add CodeQL and Dependency Review with narrow permissions
• group and label Dependabot updates with bounded pull-request counts
• replace placeholder stale messaging, add explicit windows and exemptions, and grant only issue/PR write permissions
• document the repository automation contract

Validation

• RED: 5/5 parsed-YAML contract tests failed before implementation at the intended assertions
• GREEN: focused GitHubAutomationConfigurationTest passed 5/5
• ./gradlew build --rerun-tasks --no-daemon passed on the rebased branch
• all 176 browser tests passed
• browser JUnit XML parsed successfully with testsuites root
• git diff --check passed
• pinned and roadmap protection labels were created and verified

Closes #1144
Closes #1145
Closes #1146
Closes #1147
Closes #1148
Closes #1149
Closes #1150