ci: let Dependabot pass the commit policy

[vyncint]

What & why

Every Dependabot pull request in this ecosystem has failed commit-policy.
All four ever opened did; two of them (mossaic#74, reconverge#84) were merged
with the check red.

check-no-ai-attribution.sh rejects any author or committer whose email ends
[bot]@users.noreply.github.com, and Dependabot authors as
49699333+dependabot[bot]@users.noreply.github.com.

That rule exists so a human is not displaced as the author of record. A version
bump has no human to displace — it is not somebody's work with the credit
misassigned — so a named dependency bot is now exempt from the identity
half of the check and from nothing else. The message rules still apply to its
commits in full: a bot cannot carry an AI co-author trailer, a "Generated …"
footer or a robot emoji past this.

The allowlist matches Dependabot by name rather than by GitHub's numeric user
id, anchored at both ends of the whole address, so a crafted local part such as
evil+dependabot[bot]@users.noreply.github.com is still rejected. It is a
hygiene guard rather than a security boundary — anyone can set an author email
locally — and what actually stops a forged one is review before merge.

The generated files

AGENTS.md and CONTRIBUTING.md §6 are generated from the private
ecosystem repository and were not edited here by hand — they come from
tools/gen_agents.py and tools/gen_contributing.py, so the documented
policy matches the enforced one. The ecosystem-side change lands
separately; this pull request carries its output.

Tested

tools/test-policy-scripts.sh in the ecosystem repository is new, and runs
both scripts over commits crafted to sit on each side of every rule. Half the
cases are expected failures, so a rule that stops firing shows up as a case
that unexpectedly passes.

Against the copy in this pull request: 14/14, including

• dependabot clean commit — passes (this is the fix; it failed before)
• dependabot + "Generated …" / AI co-author / robot emoji — still fails
• an unnamed [bot] address — still fails
• evil+dependabot[bot]@users.noreply.github.com — still fails
• an AI author name, an @noreply.anthropic.com address — still fail

Behaviour was diffed against the previous script over the same cases: the only
two that change are the two Dependabot ones.

What this does not do

• No CHANGELOG.md entry: nothing here is user-facing.
• Dependabot's own dependabot.yml schedule is untouched.
• I did not re-run the already-closed Dependabot pull requests; they will need
  a rebase or reopen to pick this up.

Checklist

• No issue linked — direct maintainer request
• Tested, and the tests can fail — see above
• No Rust changed, so fmt/clippy are unaffected
• All commits are signed off
• No AI attribution trailers
• CHANGELOG.md — n/a, not user-facing