ci: spell out Dependabot's directories, and three review fixes

The config was rejected: "Update configs must have a unique combination of
'package-ecosystem', 'directory', and 'target-branch'. Dependabot cannot determine
if 'npm' has overlapping directories." Globs are the problem — with several
entries per ecosystem, Dependabot will not merely assume that
/examples/remix/** and /examples/remix-zip/** are disjoint, it refuses the file.
So each entry now lists the manifest directories inside its example, derived from
`git ls-files examples`: 53 directories across 47 example entries. Three examples
have more than one manifest and keep grouping across them, which is the point —
datadog alone has five.

Key the concurrency group per pull request. Only one run per group may be pending
and a new arrival cancels the pending one, so a single group meant a burst of
Verify Examples runs finishing together — the normal case, since Dependabot opens
security pull requests in batches — would cancel each other's queued fast-path runs
until only the last survived. The overlap this allows between a sweep and a fast
path on one pull request is already handled by --match-head-commit and the
mergeStateStatus branch, which turn the loser into a skip rather than a red run.

Handle a failed API call the way the header says the script handles everything
else. Five gh lookups would abort the script bare under set -e, with no summary
line and rc=1 propagating out of the sweep loop — the opposite of the care the
merge block takes to keep this workflow's red/green meaningful. They now skip with
a reason. Author, head SHA and the check rollup also come from one `gh pr view`
call rather than three, which both simplifies that handling and cuts the sweep's
per-pull-request cost.

Read the matrix from disk rather than the API. The workflow already checks out the
default branch, and the API call read that same content, so it was a network round
trip and two failure branches for nothing. Moving the coverage check ahead of the
run and job lookups matters more than it looks: an example with no matrix entry can
never merge, and most examples have none, so those pull requests now cost two API
calls per sweep instead of four, forever.

Fifteen guard paths exercised, including the four new API-failure paths: each exits
0 with a summary line, and the only loud failure is still a merge that fails for no
discoverable reason.

Author: bnusunny