ci: add Dependabot for cargo and GitHub Actions

[don-petry]

Why?

Dependencies with known vulnerabilities or outdated actions can introduce security risks and subtle breakage. Dependabot automates the tedious work of monitoring and proposing updates, keeping the supply chain current without manual effort.

Summary

• Add .github/dependabot.yml to enable automated dependency updates
• Configures weekly Cargo dependency updates (prefixed deps)
• Configures weekly GitHub Actions updates (prefixed ci)

Addresses item 5 in #11.

Test plan

• Verify Dependabot opens PRs on the configured schedule
• Confirm PR prefixes match the configured commit-message settings

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adds a Dependabot configuration to the repository to automate weekly dependency update PRs for both Rust (Cargo) dependencies and GitHub Actions workflow dependencies, aligning with CI/quality improvements in issue #11.

Changes:

• Add .github/dependabot.yml enabling weekly updates for the cargo ecosystem at repo root, with commit message prefix deps.
• Add weekly updates for the github-actions ecosystem at repo root, with commit message prefix ci.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[don-petry]

Automated review — APPROVED

Risk: LOW
Reviewed commit: a4edcf70c002b2323f8c4d14cbfd2a4967b4aab4
Cascade: triage → deep (see triage: haiku 4.5 → deep: sonnet 4.6 → audit: opus 4.6 for models)

Summary

PR adds a standard Dependabot v2 configuration enabling weekly automated updates for Cargo and GitHub Actions ecosystems. The single file added is minimal, syntactically correct, and introduces no security risks. Triage escalated due to a procedural failure (triage-output-invalid), not a content concern; deep review finds this safe to approve.

Findings

Info

• .github/dependabot.yml — No open-pull-requests-limit set; Dependabot defaults to 5 open PRs per ecosystem. Consider setting an explicit limit if PR noise is a concern.
• .github/dependabot.yml — No reviewers, assignees, or labels configured for Dependabot-generated PRs. Adding these can improve triage and review routing.
• (CI) — mergeStateStatus is UNSTABLE with an empty statusCheckRollup. This appears to reflect the absence of required CI checks on this repo rather than a failing check; no blocking issue found.

CI status

mergeStateStatus: UNSTABLE — no required checks are configured on this repository; not blocking.

Note: Approval review could not be posted via GraphQL (token is the PR author). Review verdict is approve; a repository maintainer may approve and merge.

---

Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 → audit: opus 4.6). Reply with @don-petry if you need a human.