ci: Dependabot for pip and composite actions; CI installs pinned specs

Dependabot now watches pip requirements (root and site-template) and the
composite actions under .github/actions/*, not only top-level workflows,
with minor/patch updates grouped. The composite actions' checkout and
setup-python pins were brought up to the workflows' majors (v7 / v6) in
the previous commit. The scaffold CI job installs from requirements.txt
and requirements-test.txt instead of unpinned package names.

Closes #118

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: TMHSDigital <154358121+TMHSDigital@users.noreply.github.com>

Author: TMHSDigital

.github/dependabot.yml

@@ -1,6 +1,24 @@
 version: 2
 updates:
+  # Workflows plus the composite actions every tool repo consumes, so
+  # fleet-facing action pins do not fall behind the meta-repo's own.
   - package-ecosystem: "github-actions"
-    directory: "/"
+    directories:
+      - "/"
+      - "/.github/actions/*"
     schedule:
       interval: "weekly"
+    groups:
+      actions-minor-patch:
+        update-types: ["minor", "patch"]
+
+  # Scaffold (Jinja2), test, and site-template requirements.
+  - package-ecosystem: "pip"
+    directories:
+      - "/"
+      - "/site-template"
+    schedule:
+      interval: "weekly"
+    groups:
+      pip-minor-patch:
+        update-types: ["minor", "patch"]

.github/workflows/validate.yml

@@ -47,7 +47,7 @@ jobs:
           python-version: "3.12"
 
       - name: Install dependencies
-        run: pip install Jinja2 PyYAML
+        run: pip install -r requirements.txt -r requirements-test.txt
 
       - name: Check scaffold syntax
         run: python3 -m py_compile scaffold/create-tool.py scaffold/generator.py