ci: add Dependabot version updates (uv + github-actions)

Weekly keep-current PRs for Python deps (pyproject.toml/uv.lock) and the
GitHub Actions used by workflows. Minor/patch Python bumps are grouped into
one PR to limit noise; majors open individually. Complements the
now-enabled automated security fixes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: rustyconover

.github/dependabot.yml

@@ -0,0 +1,35 @@
+# Dependabot version updates. Security updates (PRs for flagged CVEs) are
+# enabled separately via the repo's "automated security fixes" setting; this
+# file governs the scheduled keep-current PRs.
+version: 2
+updates:
+  # Python dependencies (pyproject.toml + uv.lock).
+  - package-ecosystem: "uv"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "deps"
+    # Roll all non-breaking bumps into a single weekly PR to keep noise down;
+    # major bumps still open as individual PRs so they get reviewed on their own.
+    groups:
+      python-minor-and-patch:
+        update-types:
+          - "minor"
+          - "patch"
+
+  # GitHub Actions used by the workflows in .github/workflows/.
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "ci"
+    groups:
+      github-actions:
+        patterns:
+          - "*"