Dependabot: ignore majors the jsii toolchain cannot take (typescript, jsii)

[alphacrack]

The jsii 5.x toolchain pins TypeScript to ~5.4, so some Dependabot majors can never merge as-is and will sit open (or worse, get merged and break the build):

• PR chore(deps-dev): bump typescript from 5.4.5 to 6.0.3 #13 (typescript 5.4 → 6.0) — incompatible with jsii 5.x.
• PR chore(deps-dev): bump jsii from 5.9.44 to 6.0.5 #11 (jsii 5 → 6) — a toolchain major that must be taken deliberately, together with the TypeScript bump and a check of generated-API stability.

What to do

• Add ignore rules in .github/dependabot.yml for typescript and jsii/jsii-* major updates, with a comment explaining the jsii pinning.
• Close PRs chore(deps-dev): bump typescript from 5.4.5 to 6.0.3 #13 and chore(deps-dev): bump jsii from 5.9.44 to 6.0.5 #11 with a pointer to this issue.
• Leave a tracking note (or follow-up issue) for a deliberate jsii 6 + TS upgrade, which should be done as one coordinated change.

Acceptance criteria

• Dependabot no longer proposes majors that the jsii toolchain cannot accept, and the constraint is documented where the ignore rule lives.

[alphacrack]

Scope correction: jsii 6 (PR #11) turned out to build and pass the full CI suite (including the jsii compile and compliance jobs), so it has been merged — the "jsii major must be ignored" part of this issue no longer applies.

What remains in scope:

• typescript majors only: PR chore(deps-dev): bump typescript from 5.4.5 to 6.0.3 #13 (TS 6) still fails the build under the jsii toolchain — add a .github/dependabot.yml ignore rule for typescript majors with a comment explaining the pin, and close chore(deps-dev): bump typescript from 5.4.5 to 6.0.3 #13 pointing here.
• The ESLint-stack majors (chore(deps-dev): bump @typescript-eslint/eslint-plugin from 6.21.0 to 8.60.1 #9, chore(deps-dev): bump eslint-plugin-jest from 27.9.0 to 29.15.2 #14, chore(deps-dev): bump eslint from 8.57.1 to 10.4.1 #16) are tracked separately in Migrate to ESLint flat config to unblock ESLint 10 / typescript-eslint 8 / eslint-plugin-jest 29 #35 (flat-config migration), not via ignore rules.

[alphacrack]

Closing: no remaining scope. jsii 6 merged via #11 and TypeScript 6 via #61 (with the required tsconfig migration), so there are no majors left that the toolchain can't take — no Dependabot ignore rules needed.