Consolidate Dependabot, fix #595 (mimalloc + indexmap), add feature-matrix CI (#627)

* build: consolidate dependabot cargo entries and add commit prefixes

Consolidate all 9 separate cargo ecosystem entries into a single entry
using the 'directories' key. This ensures Dependabot creates one PR per
dependency update across the root workspace and all bindings, preventing
version skew that caused build failures.

Also add semantic commit-message prefixes to all ecosystem entries:
- build(deps) for cargo, gomod, maven, nuget, pip, bundler
- ci(deps) for github-actions

Rename the cargo group to 'rust-dependencies' and the github-actions
group to 'github-actions' for clarity.

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>

* fix: remove mimalloc from default features, fix indexmap/std propagation

Address #595: the vendored mimalloc allocator should not be imposed on
library consumers. Remove allocator-memory-limits and mimalloc from the
full-opa feature so that users of regorus as a library can choose their
own global allocator.

Bindings (ffi, java, python, ruby) that ship as standalone artifacts
continue to opt in to regorus/allocator-memory-limits explicitly so they
retain the performant allocator.

Also propagate indexmap/std via the std feature (using the indexmap?/std
weak-dependency syntax) so that users enabling std + rvm without default
features no longer hit 'IndexMap takes 3 generic arguments' errors.

Closes #595

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>

* ci: add feature-combination checks to PR CI and weekly matrix

PR CI (xtask): add cargo check for 5 non-default feature combos in
run_ci_suite(). These run on every PR and catch compile failures from
feature-gating issues (e.g. #595) with near-zero overhead.

Weekly workflow: new feature-matrix.yml runs cargo build + cargo test
across 9 feature combinations every Monday. Uses a GitHub Actions matrix
with fail-fast: false so all combos are tested even if one fails.

Combinations tested weekly:
- std,arc (minimal library)
- std,arc,rvm (common library usage)
- std,arc,full-opa (full-opa without mimalloc)
- std,arc,full-opa,allocator-memory-limits (binding-style)
- std,arc,rvm,regex,time,semver,cache (cherry-picked builtins)
- std,arc,rvm,coverage,cache (observability)
- std,arc,full-opa,azure_policy (Azure Policy)
- std,arc,full-opa,azure-rbac (Azure RBAC)
- arc,opa-no-std (no_std codepath)

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>

* fix: gate benchmark memory-limit calls behind allocator-memory-limits feature

The set_global_memory_limit function is only available when the
allocator-memory-limits feature is enabled. After removing mimalloc
from the default feature set, the rvm_benchmark failed to compile.

Add #[cfg(feature = "allocator-memory-limits")] guards around the
call sites and the MEMORY_LIMIT_BYTES constant.

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>

---------

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>

xtask/src/tasks/ci/mod.rs

@@ -242,6 +242,10 @@ fn run_ci_suite(config: CiSuiteConfig) -> Result<()> {
         )?;
     }
 
+    // Verify that important feature subsets compile correctly.
+    // These catch issues like #595 where non-default combinations fail.
+    check_feature_combinations(&workspace, config.release, config.frozen)?;
+
     Ok(())
 }
 
@@ -364,3 +368,48 @@ fn base_cargo_args(
     }
     args
 }
+
+/// Verify that various feature subsets compile.
+///
+/// Library consumers may pick non-default feature combinations.  Running
+/// `cargo check` for each combination is fast and catches regressions like
+/// issue #595 (indexmap/std not propagated) early.
+///
+/// The weekly `feature-matrix.yml` workflow runs a superset of these with
+/// full `cargo test`; these PR checks are intentionally `cargo check` only
+/// to keep CI fast.
+fn check_feature_combinations(workspace: &Path, release: bool, frozen: bool) -> Result<()> {
+    let combos: &[&str] = &[
+        // Issue #595: library consumer with std + arc + rvm but no full-opa.
+        // Validates indexmap/std propagation via the weak-dep syntax.
+        "std,arc,rvm",
+        // full-opa without mimalloc: the new default after removing the
+        // vendored allocator from full-opa. All builtins, no allocator.
+        "std,arc,full-opa",
+        // Binding-style: full-opa plus the explicit allocator opt-in.
+        // Mirrors how ffi/java/python/ruby crates are configured.
+        "std,arc,full-opa,allocator-memory-limits",
+        // no_std codepath: exercises spin_no_std + absence of std deps.
+        "arc,opa-no-std",
+        // Cherry-picked builtins: popular features without full-opa to
+        // ensure individual feature gates compose correctly.
+        "std,arc,rvm,coverage,cache,regex,time",
+    ];
+
+    for features in combos {
+        let label = format!(
+            "cargo check --no-default-features --features {} (ci)",
+            features
+        );
+        run_ci_cargo_step(
+            workspace,
+            "check",
+            release,
+            frozen,
+            Some(features),
+            &["--no-default-features"],
+            &label,
+        )?;
+    }
+    Ok(())
+}