revert(docker): pin images to 3.12 + stop Dependabot auto-merge

[19-84]

Why

Dependabot auto-merged a Python base-image bump (3.12 → 3.14) across the builder and mcp_server images (search-server was already 3.14) with no human review. CI tests on 3.12, so the 3.14 images ran a Python version the suite never validated. Running the full suite on 3.14 manually surfaced a PythonFinalizationError from psycopg's connection pool at interpreter shutdown (3.14 made joining threads during finalization an error) — a regression the 3.12 suite doesn't show. 735 tests "pass" on 3.14, but with that noisy unclean-shutdown behavior per worker.

What

1. Revert all images to Python 3.12

Image	Before	After
Dockerfile (builder)	3.14-alpine	3.12-alpine
docker/search-server/Dockerfile	3.14-alpine	3.12-alpine
mcp_server/Dockerfile	3.14-slim-bookworm	3.12-slim-bookworm
docker/leaderboard/Dockerfile	3.12-alpine	3.12-alpine (unchanged)

All images now match CI's 3.12 — which also completes roadmap Feature 11 (search-server was the original 3.14 outlier). Updated F11 to Done and removed the resolved "Docker Python" row from CLAUDE.md's deviations table.

2. Stop Dependabot auto-merge

• Removed .github/workflows/dependabot-auto-merge.yml.
• Disabled the repo allow_auto_merge setting.
• Kept: dependabot.yml coverage (uv / search-server pip / docker / actions) and main branch protection (full required-check suite). So Dependabot still opens (grouped) PRs and they still must be green — but a human merges them now, so base-image and major bumps get reviewed.

Not reverted

The other auto-merged Dependabot PRs are left in place (gunicorn 23→26 — boot-tested by the integration check, aiohttp, fetch-metadata, search-server patch group). Say the word if you want any of those rolled back too.

Verification

• search-server builds on 3.12 (Python 3.12.13 in the image)
• full suite passes on 3.12 (735 tests); the 3.14-only PythonFinalizationError is gone