fix(scaffold): ignore vitest major bumps in new mcp-servers

A vitest 4 lockfile rewrite already broke npm ci on an existing server; new repos should ship the same ignore.

Signed-off-by: fOuttaMyPaint <154358121+TMHSDigital@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

Author: TMHSDigital

VERSION

@@ -1 +1 @@
-1.19.0
+1.19.1

scaffold/templates/dependabot.yml.j2

@@ -22,6 +22,10 @@ updates:
       # of the supported runtimes.
       - dependency-name: "@types/node"
         versions: [">=23"]
+      # Hold vitest 3.x. A 4.x bump rewrote the lockfile without optional
+      # esbuild platform packages, so npm ci failed. Major upgrades stay manual.
+      - dependency-name: "vitest"
+        update-types: ["version-update:semver-major"]
 {% endif %}
 {% if has_mcp %}
   - package-ecosystem: "pip"

tests/test_scaffold_born_green.py

@@ -338,6 +338,9 @@ def test_deployed_service_shape(rendered):
     assert "gh workflow run publish.yml" in (
         library / ".github" / "workflows" / "release.yml"
     ).read_text(encoding="utf-8")
+    dep = (library / ".github" / "dependabot.yml").read_text(encoding="utf-8")
+    assert 'dependency-name: "vitest"' in dep
+    assert "version-update:semver-major" in dep
 
 
 def _make_temp_registry_root(tmp_path: Path) -> Path: