ci: add explicit release permissions, drop dead dependabot-automerge workflow (#10)

Part of the repo-baseline convergence pass
(unional-skills:apply-repo-baseline):

- Grant the `release` job in `release.yml` its own
`id-token`/`contents`/`pull-requests` permissions so the default Actions
token can be lowered to `read` afterwards without breaking the release.
- Drop `.github/workflows/dependabot-automerge.yml` — it only fires for
actor `dependabot[bot]`, and this repo has no `.github/dependabot.yml`,
so it has never run. Renovate is already the configured updater
(`.github/renovate.json`).

No changeset — this is repo-internal CI/config only, nothing published
changes.

Author: unional

.github/workflows/codeql-analysis.yml

@@ -12,4 +12,8 @@ jobs:
   release:
     uses: cyberuni/.github/.github/workflows/pnpm-release-changeset.yml@v2
     needs: code
+    permissions:
+      id-token: write
+      contents: write
+      pull-requests: write
     secrets: inherit