feat: add dependency cooldown

[dewabisma]

Basically adding the dependency cooldown workflow. Enforcing in repo rules will be done later because doesn't have permission.

[n13]

Reviewer model: GPT Sol

APPROVE — the two callers match the shared v1 adoption templates, use least-privilege read permissions, and trigger on the events needed to re-evaluate emergency bypass metadata. No blocking findings.

Validation:

• Reviewed the complete f885ad5...b79b94c diff and the referenced shared workflow/action at v1 (32aabd71).
• The live dependency-cooldown / Dependency cooldown job passed on this head.
• Ran the shared checker locally in PR mode: Cargo.lock found, 0 newly introduced versions, pass.
• Ran audit mode over all 80 locked versions: pass, with the intended non-blocking warning for the existing 27-day-old ar_archive_writer@0.5.3.
• Both YAML files parse cleanly; git diff --check passes; all current GitHub checks are green.

As noted in the PR description, the status check still needs to be made required in the repository ruleset before it becomes a merge gate; that administrative follow-up is outside this patch.