Fix source generator delivery + DI mapper resolution; bump deps

[ivahno]

Summary

The 1.0.0 packages never delivered the Roslyn generator to consumers — dotnet add package OpenAutoMapper generated nothing and generic ProjectTo<T> threw CS1061. This PR makes a single install deliver the generator, fixes a DI runtime bug found while verifying, adds a packaged-consumer smoke test, and applies the pending Dependabot bumps.

Packaging fix

• Bundle the generator into the OpenAutoMapper meta-package under analyzers/dotnet/cs. The generator DLL is staged into the project's own obj/ during build and packed via a static None from there — safe under the release --no-build pack and free of the multi-TFM pack race that intermittently dropped the analyzer.
• DependencyInjection: PrivateAssets="contentfiles" so the single analyzer copy flows transitively to DI-only consumers (no duplicate generator → no double-generation).
• release.yml: fails the release if the meta-package is missing the generator.

DI runtime fix

• The generator now also registers MapperFactoryWithServiceCtor (used by CreateMapper(serviceCtor)); previously resolving IMapper from DI threw "No mapper factory registered". Adds a generator regression test.

Testing

• eng/package-smoke-test.sh + CI package-smoke job: packs the real packages, installs them into a throwaway consumer, and asserts direct + DI mapping actually work — the gap that let both bugs ship (in-repo tests don't wire the generator as an analyzer).
• Build clean (0 warnings), 566 tests pass, smoke test 15/15.

Dependencies (Dependabot #12/#15/#16/#19/#20/#21/#28 + part of #29)

• Actions: upload-artifact v7, configure-pages v6, upload-pages-artifact v5, deploy-pages v5, action-gh-release v3.
• NuGet: DI.Abstractions / Logging.Abstractions 10.0.8, SourceLink 10.0.300, NET.Test.Sdk 18.6.0, coverlet 10.0.1, FluentAssertions 8.10.0, Mapster 10.0.7.
• Held: Microsoft.CodeAnalysis.* stays on 4.x/3.x — 5.x (ships with the .NET 10 SDK) would emit CS9057 and disable the generator for consumers on .NET 8/9 SDKs. dependabot.yml now ignores major bumps for those packages.
• Version → 1.0.1.