Adopt the fleet's dependabot config and auto-merge gate

[soodoku]

allocator had neither, while ~35 repos in the fleet have both. Copied unchanged from calibre so there is one policy rather than a second dialect of it.

What it does

dependabot.yml watches the uv and github-actions ecosystems weekly, with a seven-day cooldown so a release has to survive a week in the wild before it's proposed — security updates skip the cooldown. Updates are grouped into minor-and-patch and security sets.

dependabot-auto-merge.yml then arms gh pr merge --auto for the eligible ones:

eligible	not eligible
GitHub-Actions updates	Python majors — commented and left open
minor-and-patch groups
patch/minor Python bumps

--auto is the part that matters: it merges only once the required checks pass, so this is auto-merge behind the tests rather than instead of them.

Why it's worth having now

Only because of the two changes before it. Until uv.lock was committed there was nothing for dependabot to bump, and until CI installed with uv sync --locked a dependency bump wasn't validated against anything.

The four dependabot PRs already open (#6–#9) are lock-only transitive updates, and all four are green across the full 8–10 check matrix — which is the evidence that the loop now works end to end. Under this policy #7 (pillow minor) and #8 (pyasn1 patch) would auto-merge; #6 (cryptography major) and #9 (black major) would be left for review, which is the right call.

Not adopting preen here: allocator has no .copier-answers.yml, and adopting the py-canon template rewrites [tool.*] blocks and workflow shims. That's a separate decision from dependency hygiene.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.