DependencyManifest recognizes chore(deps) commits but never releases them

## Context

#2584 (merged, shipped in 17.2.0+) taught `DependencyManifest` to parse Dependabot's `chore(deps): bump X from Y to Z` (and `build(deps): …`) commit format, in addition to Renovate's `deps: update dependency …`. The intent, matching #2295, was to let users who opt into `"versioning": "dependency-manifest"` get releases that mirror the semver magnitude of their dependency updates.

## The gap

The PR only wired up commit *parsing* inside `DependencyManifest.bump()`. The end-to-end release pipeline still has a second gate that blocks these commits:

1. `buildNewVersion` → `versioningStrategy.bump()` — ✅ now computes the correct next version from a `chore(deps):` commit.
2. `buildReleaseNotes` → renders the changelog using `changelog-sections`. `chore` and `build` are `hidden: true` in `DEFAULT_CHANGELOG_SECTIONS` (`src/util/filter-commits.ts`), so the rendered body is empty.
3. `Strategy.buildReleasePullRequest` bails out via `changelogEmpty(...)` (`src/strategies/base.ts`) — no release PR is opened.

Net effect: a user who follows the docs, sets `"versioning": "dependency-manifest"`, and merges a Dependabot PR on `main` gets no release. The only way to unblock it today is to also unhide `chore` via `changelog-sections`, which is a blunt instrument — it promotes *every* `chore` commit (formatting, tooling, etc.) into the changelog and release path, which is not what the user asked for.

## Repro

1. `release-please-config.json` with a single package: `{ "release-type": "node", "versioning": "dependency-manifest" }`
2. Push a commit: `chore(deps): bump foo from 1.2.3 to 1.3.0`
3. Expected: release PR is opened bumping the package minor (mirroring foo's minor bump).
4. Actual: no release PR; logs show "No user facing commits found since … - skipping".

## Proposed fix

**Option A (preferred):** when `versioning: "dependency-manifest"` is active, treat commits matching the dep-update regexes as user-facing and render them into a dedicated "Dependencies" section, regardless of their underlying type being hidden. This keeps the opt-in boundary clean and leaves behavior for every other project unchanged.

**Option B:** bypass `changelogEmpty` when `DependencyManifest` produced a non-zero bump. Simpler, but releases a PR with a blank changelog body, which isn't great UX.

I'd lean toward Option A and am happy to put up a PR if the approach sounds right.

## Refs

- #2295 — original request
- #2584 — parser support (merged)