ci: group vitest bumps so the plugin tracks the core major

vitest and @vitest/coverage-v8 are version-locked; ungrouped, a major
lands as two PRs that each mix v5 with v4 and crash coverage (#188, #189).

Assisted-by: Claude:claude-opus-4-8

Author: rolandjitsu

.github/dependabot.yml

@@ -17,7 +17,15 @@ updates:
       - dependency-name: "waku"
     # Patch bumps grouped into one PR (auto-merged on green CI); minor bumps
     # grouped into a separate PR for manual review; majors open individually.
+    # Exception: vitest and its plugins are locked to the same major, so a
+    # split bump crashes coverage (#188, #189). Keep them in one group across
+    # every update type; this group is first so it claims them before the
+    # patch/minor catch-alls below.
     groups:
+      vitest:
+        patterns:
+          - "vitest"
+          - "@vitest/*"
       patch:
         patterns:
           - "*"