Security: Dependabot for pip/uv, GitHub Actions, and npm

[caidurbin]

What to build

Add Dependabot to keep dependencies and pinned action SHAs current. Configure update ecosystems for Python (pip/uv), GitHub Actions, and npm, with sensible scheduling/grouping. This also keeps the first-party action SHA pins fresh and gives zizmor a Dependabot config to audit.

Acceptance criteria

• .github/dependabot.yml covers pip/uv, github-actions, and npm
• Update schedule and grouping configured to limit PR noise
• Dependabot opens update PRs successfully

Blocked by

None - can start immediately

[caidurbin]

This was generated by AI during triage.

Agent Brief

Category: enhancement
Summary: Expand the Dependabot config to cover Python (uv/pip), GitHub Actions, and npm, with scheduling and grouping to limit PR noise.

Current behavior:
A Dependabot config exists but declares only the github-actions ecosystem. The Python manifests (pyproject.toml + uv.lock) and the npm manifest (package-lock.json) are present but unmanaged — so Python and npm dependencies, and first-party pinned action SHAs, drift without update PRs.

Desired behavior:
Dependabot keeps all three ecosystems current: Python, GitHub Actions, and npm. For the uv-managed Python deps, use the native uv package-ecosystem. Scheduling and groups: are configured so minor/patch bumps are batched rather than opening a flood of individual PRs. This also keeps action SHA pins fresh and gives a workflow static-analyzer (see #43) a Dependabot config to audit. On this public repo, version updates activate from the config file itself — no repo-settings toggle is needed.

Key interfaces:

• The Dependabot config file — add updates entries for the uv (Python), github-actions, and npm ecosystems, each with a schedule and grouping to cut noise. Point each at the correct manifest directory.

Acceptance criteria:

• Config covers Python (uv/pip), github-actions, and npm ecosystems
• Update schedule and grouping are configured to limit PR noise
• Config is valid (Dependabot accepts it; update PRs open on the public repo)

Out of scope:

• Auto-merge automation for Dependabot PRs.
• Changing dependency versions by hand — that is Dependabot's job once configured.