[dennisadriaans]

Summary

• Require manual dispatch for both the npm CLI and GitHub release workflows.
• Update the release runbook with the manual publishing step.
• Disable automatic Dependabot version and security-update PRs for npm and GitHub Actions.
• Disable automatic Dependabot rebasing.

Test plan

• Verify both release workflows declare only workflow_dispatch with a required tag input.
• Verify every configured Dependabot ecosystem has a zero PR limit and ignores all dependencies.
• Confirm pushing a new release tag no longer starts publishing.
• Confirm no new automatic dependency-update PRs are opened after merging.