ci: add PR trigger, read-only permissions, and Dependabot config

- Trigger CI on pull_request targeting main and develop (in addition to push)
- Set workflow-level permissions to read-only by default (least privilege)
- Add dependabot.yml for weekly npm and GitHub Actions dependency updates

Author: tech-stack-studios

.github/dependabot.yml

@@ -0,0 +1,24 @@
+version: 2
+
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    # Group minor/patch updates together to reduce PR noise
+    groups:
+      dev-dependencies:
+        dependency-type: "development"
+      production-dependencies:
+        dependency-type: "production"
+        update-types:
+          - "minor"
+          - "patch"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"

.github/workflows/ci.yml

@@ -4,6 +4,15 @@ on:
   push:
     branches:
       - develop
+      - main
+  pull_request:
+    branches:
+      - develop
+      - main
+
+# Least-privilege default: all jobs get read-only access unless overridden
+permissions:
+  contents: read
 
 jobs:
   # ─── Job 1: Run all unit tests ────────────────────────────────────────────────