Fix: detect and prevent Dependabot fan-out

[hyperpolymath]

What changed

• Adds supply-chain rule SC012 for repeated ecosystem blocks, excessive single-ecosystem limits, repository-wide projected capacity, and ungrouped multi-directory configs.
• Adds five focused rule tests.
• Consolidates Hypatia's own Cargo directories and bounds all version-update queues.
• Makes the Dependabot auto-fixer generate grouped limits of three (two for Actions).
• Stops emitting unsupported hex/Zig-only configurations.

Root cause

The estate had no admission rule for Dependabot configuration fan-out, while the auto-fixer generated independent queues with limits of five or ten.

Validation

• Focused suite: 23 tests, 0 failures
• SC012 run against seven corrected critical repositories: no findings
• Generator fixtures for Cargo, Mix, Deno/npm, Actions, Gleam-only, and Zig-only repositories
• YAML, Bash syntax, ShellCheck, formatter, and diff checks pass

The full pre-existing suite currently reports 43 unrelated supervisor/on-exit failures; the focused supply-chain suite is green.