Add Dependabot config

[eddeee888]

Description

Renovate was disabled in #10997. This adds .github/dependabot.yml so Dependabot takes over dependency updates, with one PR per package.

• Tier 1: published packages and root tooling. Updated weekly. Minor and patch updates go into one grouped PR per package directory. Each major gets its own PR, and so does each package that renovate.json excluded from its group (@changesets/*, typescript, @theguild/*, @whatwg-node/*, graphql-jit, husky, @types/lz-string, swc*).
• Tier 2: website, dev-test/* and examples/**. Updated monthly, with everything grouped into one PR per directory.
• GitHub Actions. Updated monthly in one grouped PR.
• A 1-day cooldown, matching minimumReleaseAge in pnpm-workspace.yaml.
• Ignored: packages pinned through pnpm-workspace.yaml overrides (graphql, @typescript-eslint/*, @rushstack/eslint-patch, jiti), plus bob-the-bundler, whose version is tied to a patch file. These have to be updated by hand together with the overrides.

Type of change

• New feature (non-breaking change which adds functionality)

How Has This Been Tested?

• The YAML parses. The real check is the first run's log under Insights → Dependency graph → Dependabot.

Further comments

• It's not yet confirmed that Dependabot supports pnpm 11 (the repo uses 11.24). Check the first run's log.
• Dependabot has no equivalent for Renovate's automerge or lockfile maintenance. Both would need separate workflows.
• Check that the shared changesets-dependencies.yaml workflow also runs on dependabot[bot] PRs.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Q3otKh8cK1c4pvjPZDaLHD

---

Generated by Claude Code

[changeset-bot]

⚠️ No Changeset found

Latest commit: e7ae231

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[eddeee888]

I think we need a config file like this, otherwise dependabot won't show packages to update: