ci: Friday release train (L1, memory-core dep-bump)

[vreshch]

Fully automated Friday release train for @agentage/server-memory (Level 1, dep-driven).

What

• New workflow .github/workflows/release-train.yml: weekly Friday 21:00 Europe/Prague MINOR release to npm.
• .github/dependabot.yml: dropped the semver-major ignore block to match the org standard (all updates come through, just grouped).

Train shape (mirrors find-mcp)

• Two DST crons (0 19 * * 5, 0 20 * * 5); Prague-hour gate proceeds only when TZ=Europe/Prague date +%H == 21 (runs after memory-core's 20:00 train so it can pull the fresh core).
• Dependabot-quiescence: wait-only (org triage owns dependabot merging).
• Release job: guard against an open release PR -> detect releasable commits (exclude docs/ci/plain-chore; chore(deps) counts) -> bump every @agentage/* dep to latest via npm-check-updates -> a dep change ALONE justifies releasing -> MINOR bump package.json -> npm run verify as the integration gate against the bumped memory-core (red verify fails the train, PR stays open) -> create + auto-merge release PR -> dispatch publish.yml (GITHUB_TOKEN merges never fire push triggers).
• permissions: actions: write so the train can dispatch publish.yml.

publish.yml already accepts chore(release): X.Y.Z and workflow_dispatch - no change needed.

Verified locally: npm ci + npm run verify green; all YAML validated with yaml.safe_load.