Group dependency updates and centralize tool pins

[ludfjig]

Group routine Dependabot updates by ecosystem while keeping benchmark runtime dependencies under manual control. Centralize Cargo-installed tool versions so CI and local setup share the same pins and can test explicit Git revisions.

Summary

• group Cargo, npm, and GitHub Actions updates
• ignore Hyperlight, Wasmtime, JCO, QuickJS, and componentizer runtime updates
• extract pinned tool installation into scripts/setup-tools.sh
• support Hyperlight AOT and componentize-QJS Git revision overrides
• include tool pins in Rust cache keys and document explicit local setup

Validation

• parsed workflow and Dependabot YAML
• checked shell syntax and Just recipe expansion
• exercised default, benchmark-only, and Git revision paths with fake tools
• ran git diff --check

The full test suite was not run.