chore: reduce dependabot noise + gate the mirror's GitLab CI honestly

dependabot: collapse routine cargo churn into two grouped weekly PRs (minor/patch
and major, separately) instead of one branch per crate, add a grouped entry for the
tools/usdt-bridge crate, and cap open PRs — this is what was flooding the repo.

.gitlab-ci.yml: this repo mirrors github, where the authoritative full CI runs on the
identical code. GitLab has no self-hosted runners registered on this namespace and the
shared-runner quota is exhausted, so the heavy pipeline can never pass here. Gate it
opt-in (RUN_GITLAB_CI=true) so the mirror stops showing perpetually-failing pipelines;
re-enable once a `pezkuwi-runner` is registered and minutes exist.

.github/dependabot.yml

@@ -1,31 +1,43 @@
 version: 2
 updates:
-  # Update github actions:
+  # GitHub Actions — one grouped PR/week for all workflow action bumps.
   - package-ecosystem: github-actions
     directory: '/'
     labels: ["A1-insubstantial", "R0-no-crate-publish-required"]
     schedule:
       interval: weekly
+    open-pull-requests-limit: 3
     groups:
       ci_dependencies:
         patterns:
         - "*"
-  # Update Rust dependencies:
+
+  # Rust workspace (root). Collapse the routine churn into TWO grouped PRs a week
+  # (minor/patch together, major together) instead of one PR per crate — otherwise
+  # every unrelated bump opens its own branch and floods the repo (the reason we had
+  # to batch-close a pile of them). Majors stay in their own group so they still get
+  # a deliberate review before merge.
   - package-ecosystem: "cargo"
     directory: "/"
     labels: ["A1-insubstantial", "R0-no-crate-publish-required"]
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 5
     groups:
-      # We assume these crates to be semver abiding and can therefore group them together.
+      cargo-minor-patch:
-      known_good_semver:
+        update-types: ["minor", "patch"]
+      cargo-major:
+        update-types: ["major"]
+
+  # usdt-bridge is a separate crate/workspace with its own Cargo.lock; group its bumps
+  # so the bridge never spawns per-crate PRs of its own (e.g. the stray rand/rustls ones).
+  - package-ecosystem: "cargo"
+    directory: "/tools/usdt-bridge"
+    labels: ["A1-insubstantial"]
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 3
+    groups:
+      bridge-deps:
         patterns:
-        - "syn"
+        - "*"
-        - "quote"
-        - "log"
-        - "paste"
-        - "*serde*"
-        - "clap"
-        update-types:
-        - "minor"
-        - "patch"

.gitlab-ci.yml

@@ -33,6 +33,16 @@ variables:
 # ── Workflow: avoid duplicate pipelines ───────────────────────────────────────
 workflow:
   rules:
+    # OPT-IN. This repo is a mirror of github.com/pezkuwichain/pezkuwi-DKS, where the
+    # authoritative full CI already runs on the identical code (github public runners +
+    # self-hosted substrate-build / dks-runner-1). Reproducing that heavy pipeline here
+    # needs self-hosted GitLab runners tagged `pezkuwi-runner` (none are registered on
+    # this namespace) plus CI minutes for the light jobs (the shared-runner quota is
+    # exhausted). Rather than auto-run a pipeline that can never pass, it is gated:
+    # set the CI/CD variable RUN_GITLAB_CI=true (Settings > CI/CD > Variables) once a
+    # `pezkuwi-runner` is registered and minutes are available, then it runs as below.
+    - if: '$RUN_GITLAB_CI != "true"'
+      when: never
     - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
     - if: $CI_MERGE_REQUEST_IID
     - if: $CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+$/