ci: add Dependabot and auto-merge for hotdata SDK updates

[eddietejeda]

Adds daily Dependabot checks scoped to hotdata and hotdata-runtime packages, and an auto-merge workflow that squash-merges those PRs once all checks pass.

• dependabot.yml: watches the correct package ecosystem (uv where uv sync --locked is used in CI, pip otherwise), scoped via allow: to hotdata packages only
• dependabot-automerge.yml: enables squash auto-merge on any PR opened by dependabot[bot]

[claude]

Review

Blocking Issues

• .github/dependabot.yml: PR title and description claim "Dependabot and auto-merge for hotdata SDK updates," but the diff only adds a generic pip Dependabot config. There is no auto-merge workflow, and the config is not scoped to hotdata packages — it will open daily PRs for marimo, pytest, hotdata-runtime, and hotdata alike.

Action Required

Pick one:

1. Land what the description promises in this PR — add an allow filter (and probably labels) so Dependabot only opens PRs for hotdata / hotdata-runtime, and add a workflow that calls gh pr merge --auto --squash on Dependabot PRs targeting those packages once checks pass.
2. Narrow the PR description to match the diff — "adds daily Dependabot for pip dependencies" — and follow up with the auto-merge workflow in a separate PR.

Either is fine; the current mismatch between description and code shouldn't merge as-is.