ci: run weekly Dependabot updates on the weekend

[solace-aross]

What

Weekly Dependabot runs move to the weekend at 06:00 Eastern: github-actions and docker on Saturday, cargo on Sunday. Everything else is unchanged: one PR per dependency (no groups), 7-day cooldown, default open-pull-requests-limit of 5.

Why

Since the switch to weekly, the scheduled run lands on Monday around midday Eastern. On Oct 5 it opened 6 PRs, and their CI ran during the working day alongside merge-queue runs, under the 20-job cap. A weekend run puts that creation-time CI, and the on-schedule rebase of open PRs, off weekday hours. Cargo gets its own day because it opens most of the PRs.

What this does not do

• It does not change how many PRs open. Expect roughly 5 to 7 fewer Tier A runs on weekdays, an estimate from the Oct 5 burst.
• It covers scheduled runs only. Most other post-switch bursts followed edits to dependabot.yml, which appear to trigger a run (the docs do not state this outright). Merging this change will likely trigger one weekday run; cargo has 4 of its 5 slots in use, so at most one new cargo PR is possible.
• I left open-pull-requests-limit at 5. A lower limit would let the long-open major bumps (datafusion, slatedb) block newer ones.
• Security updates are not subject to the limit or the cooldown (options reference).

No existing Dependabot PRs are touched.

🤖 Generated with Claude Code

[solace-wkourlas]

lgtm