Parity follow-ups from lstr modernization: MSRV, Dependabot, devel branch

[bgreenwell]

Follow-ups from the dependency/workflow modernization completed in lstr (and partially present in doxx):

• Declare MSRV: the dependency tree's floor is 1.88 (ratatui 0.30), but Cargo.toml has no rust-version field and the README badge claims rust 1.70+. Add rust-version = "1.88", verify with cargo +1.88.0 check --all-targets, and fix the badge.
• Enable Dependabot: doxx and lstr both run the tuned config (weekly cargo + github-actions, minor/patch grouped, majors as individual PRs); xleak has no .github/dependabot.yml. Port it from either repo. Note the release-checklist caveat: Dependabot PRs touching the generated release.yml should be closed in favor of a cargo-dist version bump + dist generate.
• Consider the devel-branch model: doxx and lstr now use devel as the default/integration branch with main tracking releases. Adopting it here would make the workflow uniform across all three tools — optional, maintainer's call.

Reference implementations: bgreenwell/lstr#62 (devel + Dependabot) and bgreenwell/lstr#71 (MSRV declaration and badge fix).