feat(automerge): restrict auto-merge to configured days of the week

Summary

Add a config option to limit auto-merge to specific days of the week, so teams can align dependency merges with their release cadence and avoid merging right before train pushes or the weekend.

Motivation

On mozilla/fxa we push to prod on a train schedule. We'd like Dependabot updates to auto-merge only on days when someone is around to watch them land — e.g. Mon and Thu, skipping Tue/Wed (train pushes) and Fri + weekend. Today auto-merge runs on the ~30-min sweep with no day/time controls, so a safe-but-unwatched merge can land at an awkward moment.

Proposed behavior

• New optional config under automerge, e.g.:

  automerge:
    allowed_days: [mon, thu]      # empty/unset = all days (current behavior)
    timezone: America/Los_Angeles # days evaluated in this tz; default UTC
  

• When allowed_days is set, a PR that passes all existing auto-merge checks is only merged if the current day (in timezone) is in the list. Otherwise it's held and re-evaluated on the next eligible day's sweep.
• Unset/empty allowed_days preserves today's behavior exactly.
• Configurable per-repo via .blender/blender.yml, falling back to config/defaults.yml.

Notes / open questions

• Day evaluated at merge time (sweep tick), not PR-open time — is that the expected semantics?
• Worth a companion allowed_hours window later, but out of scope here unless trivial.
• BLEnder's comment on a held PR should say why it's waiting and when it'll retry (ties into the spirit of #67).

Docs

Update README.md auto-merge section (and any config reference) to document allowed_days / timezone in the same PR.

Start with the auto-merge sweep and configuration flow, then inspect config/defaults.yml and the per-repository .blender/blender.yml location. Update README.md's auto-merge section and config reference; done means eligible merges respect allowed_days and timezone, held PRs retry on eligible sweeps, and unset or empty settings preserve current behavior.