fix(deps): cover standalone PyO3 Cargo lock in Dependabot

[seonghobae]

Defect

pyproject.toml builds the Python extension from the excluded standalone manifest crates/fast-mlsirm-py/Cargo.toml, but .github/dependabot.yml has Cargo update roots only for / and /fuzz; it does not monitor /crates/fast-mlsirm-py.

This allows a root Cargo dependency PR to be green while the independently locked wheel graph remains on a predecessor version. Current examples make the gap concrete: #1682 updates root wgpu to 30.0.1 while the standalone PyO3 lock remains on 30.0.0, and #1694 updates root sha2 to 0.11.0 while that standalone lock remains on 0.10.9 until explicitly regenerated.

Acceptance

• add the excluded PyO3 manifest directory as its own Cargo Dependabot update root;
• add a regression contract proving every repository-owned standalone Cargo manifest/lock root used by package/fuzz execution is represented in .github/dependabot.yml;
• do not remove lockfiles, weaken --locked verification, or broaden dependency ranges;
• keep package/runtime/statistical behavior unchanged.

This is dependency/supply-chain control-plane coverage only; no psychometric arithmetic changes.