chore: remove npm from Dependabot — npm stays human-controlled (#91)

npm version-updates are now human-controlled; package.json stays
human-managed and Renovate deliberately does not manage npm on this
repo.

The github-actions ecosystem was already migrated to Renovate (cutover
#72), so npm was the last remaining Dependabot ecosystem. This deletes
`.github/dependabot.yml` entirely, fully disabling Dependabot
version-update PRs.

Note: this does NOT touch Dependabot security alerts (a separate GitHub
setting), which remain enabled.

Author: jpr5