chore: enable Python Dependabot coverage with release-age cooldowns - #4964

Summary

Dependabot currently checks only GitHub Actions. Add weekly updates for the root uv project and both standalone Twilio requirements manifests, with seven-day cooldowns for ordinary Python and Actions updates. Retain the monthly Actions schedule and bound ordinary update PR volume.

Document the administrator security-update toggle and an approved, package-specific uv timestamp exception for urgent fixes. GitHub's security-update cooldown exemption does not disable uv's separate resolver policy. No dependency versions or lockfiles change; unpinned example requirements do not provide a locked transitive inventory.

Test plan

• Validated YAML against the current Dependabot schema and checked manifest ownership, schedules, cooldowns and security-related options.
• Ran synthetic uv lock and uv pip compile scenarios: the approved package-specific timestamp admits a fresh fix while another fresh package remains excluded; removal restores the cooldown.
• git diff --check passes.
• Two consecutive clean adversarial-review rounds, each with two independent fresh-context reviewers, including security review.
• Full SDK checks are not applicable to this repository-meta-only configuration change. The existing baseline uv lock --check --offline fails under local uv 0.12.8; dependency remediation remains separate from this PR.

After merge, an administrator must enable Dependabot security updates, currently disabled, and verify hosted jobs discover all configured manifests and eligible security updates run promptly. This PR does not change repository settings.

Issue number

None.

Checks

• Focused configuration and synthetic security-exception checks pass.
• Two clean independent review rounds completed.
• Diff is limited to Dependabot configuration.
• Post-merge: enable security updates and verify hosted rollout.