feat: automatic Deno version bumps

[TomChv]

Keep the module's pinned default Deno version current, automatically and safely.
Implements designs/auto-version-bump.md.

What

• .dagger/modules/maintenance — a Maintenance Dang module:
  • latestDenoVersion resolves the newest stable release from denoland/deno's
    git tags natively (git(...).tags + a semver-max helper) — no GitHub API
    auth/rate-limit dance.
  • bumpDenoVersion(ws, version) rewrites the version default in deno.dang
    and the illustrative versions in README.md, returning one Changeset to
    preview/apply. Deliberately not a @generate (a bump is network-dependent
    and non-idempotent, so it never fires on dagger generate).
• .github/workflows/bump-deno-version.yml — weekly + workflow_dispatch
  job: apply the bump → verify with dagger check (the e2e suite runs on the
  default version, so one gate covers both "the new tag's images are published"
  and "the samples still pass") → open a single rolling PR via
  peter-evans/create-pull-request. No auto-merge; the engine pin is read from
  dagger-module.toml and installed directly via the action's version: input.

Verified

• dagger check: 15/15 (includes the new module codegenning clean).
• latest-deno-version → 2.9.3 (current latest, so a default bump is correctly a
  no-op today); bump-deno-version --version 3.0.0 rewrites deno.dang + the three
  README.md examples and leaves the unrelated 2.5.0 reference intact.
• Both action input schemas confirmed against their action.yml; actionlint clean;
  the pinned beta CLI is installable via the action's version: (release tarball
  present on dl.dagger.io).

Ops

• Requires a DAGGER_CLOUD_TOKEN repo secret (Dagger Cloud traces).
• Workflow permissions: id-token: write so Dagger Cloud can authenticate via
  a GitHub OIDC token, plus contents: write and pull-requests: write so
  create-pull-request can push the bump branch and open the PR. (A permissions
  block defaults everything unlisted to none, so all three are declared explicitly —
  contents must stay write, not read, or the PR step can't push.)
• The scheduled job's full end-to-end run (dagger-for-github + create-pull-request
  inside a runner) is only truly exercisable once merged / manually dispatched.