ci(deps): bump PyO3/maturin-action from 32307a466a178317e8c2ae343b38e73896a047be to 53965ae436bfa278197425c78ac1e3eeebc7cc33 - #117

## Summary

**Auto-merge for Dependabot.** The other organisation repositories run a
`dependabot-auto-merge` workflow; this one had none, so every update
waited for a manual merge. This adds it (the coordinode-lsm-tree
version, actions pinned by SHA as in this repository's CI).
- On a pull request Dependabot opened or pushed, it approves and arms
auto-merge; GitHub merges once every check the default-branch ruleset
requires has passed.
- Every ecosystem merges this way, majors included, except a **major
GitHub Actions update** (several actions run only in `release.yml` on a
tag) and **any Docker update** (no job builds the demo image): those
stay manual.
- A push by anyone else disarms an armed merge; a maintainer's reopen
re-arms it (fetch-metadata refuses a branch holding anyone else's
commits); approval and merge are bound to the inspected head SHA.
`pull_request_target` with no checkout. In the organisation's other
repositories, Dependabot-triggered runs of this workflow get the Actions
secrets and merge workflow-file updates with the contents and
pull-requests grants alone.

**Every dependency to its latest release** (replaces the open Dependabot
pull requests #117-#123):
- `coordinode-embedded`: PyO3 0.24 -> 0.29 and rust-numpy 0.24 -> 0.29,
which also clears the PyO3 advisory fixed only in 0.29; the code follows
the renamed API (`Py<PyAny>`, `PyOnceLock`, `Python::detach`,
`Bound::cast`). The rest of `Cargo.lock` at the newest compatible
versions.
- `uv.lock` upgraded throughout, majors included where the declared
ranges allow; grpcio and grpcio-tools level at 1.84 for the generated
stubs, and `coordinode` now requires `grpcio>=1.84.0`, the runtime those
stubs accept (a new unit test holds the grpcio and protobuf floors to
the generated code); openai stays 2.x (capped by
llama-index-llms-openai).
- GitHub Actions: checkout v7.0.1, setup-uv v10.2.0, maturin-action
v1.51.0, upload-artifact v7.0.1, download-artifact v8.0.1, setup-python
v7.0.0, setup-qemu v4.4.0, action-gh-release v3.0.3,
create-github-app-token v3.2.0, release-please-action v5.0.0. Their
breaking changes (Node 24, ESM, download-artifact failing on a digest
mismatch, setup-uv disabling its cache on `pull_request_target`) touch
no input these workflows use.
- The demo image's uv stage to 0.12.23.

## Testing

- Unit tests: 367 passed (incl. the runtime-floor test, seen failing on
the old floor), embedded extension built on PyO3 0.29 (release profile),
none skipped.
- Integration tests: 94 passed against a 0.7.0 server.
- `cargo clippy -D warnings` and `cargo fmt --check` clean; ruff check
and format clean.
- Demo image rebuilt on the upgraded lock; all five notebooks executed
with `nbconvert --execute`.
- Not exercisable before a tag: the release-only actions
(download-artifact, action-gh-release, setup-python, setup-qemu);
checked against their release notes.