chore: add environment deps auto-bump workflow

[samsja]

Adds a scheduled/manual/repository-dispatch workflow to bump the environment dependency submodules:

• deps/verifiers
• deps/renderers
• deps/research-environments

The workflow initializes deps/pydantic-config as a support submodule for lockfile resolution, refreshes uv.lock when a bump is found, validates the lockfile with a dry-run sync, opens or updates a non-draft bump PR, and enables GitHub auto-merge with a head-SHA guard.

The docs now list the workflow and call out the required AUTO_BUMP_TOKEN secret. A real PAT or GitHub App token is needed so bot-created bump PRs trigger the normal PR workflows before auto-merge.

Validation run locally:

• uvx --from actionlint-py actionlint .github/workflows/auto_bump_environment_deps.yaml
• uv lock --check
• uv sync --all-extras --locked --dry-run

Also ran an end-to-end temp worktree dry run of the bump flow. At the time of testing it would bump only deps/verifiers from 22d6333 to 5885ab9; after rebasing, current main already contains that gitlink.