ci: add dependabot config for action updates and cargo security updates

[avi-starkware]

Adds .github/dependabot.yml:

• github-actions, weekly, one grouped PR. All actions are now SHA-pinned, so nothing moves them otherwise; Dependabot rewrites the SHA and the same-line # vX comment. Note: Dependabot does not raise security alerts for SHA-pinned actions — only this weekly version group moves them.
• cargo, security updates only: open-pull-requests-limit: 0 disables version updates while security updates are unaffected; grouped via applies-to: security-updates.
• No pip: the requirements.txt files are pip freeze outputs generated from *-gen.txt; Dependabot editing the frozen file would desync it from its definition.

Reviewer check needed: the cargo block only does anything if Dependabot security updates is enabled in Settings → Code security (admin-only to read; state unknown from a non-admin token).

Dependabot PRs can't read repo secrets; optimize_ci degrades gracefully (Graphite action logs a 401 warning and sets skip=false), so their CI runs normally.

🤖 Generated with Claude Code

[reviewable-StarkWare]

This change is 

[cursor]

PR Summary

Low Risk
Adds CI automation config only; no application, auth, or runtime code changes. Cargo security PRs depend on org/repo Dependabot security settings being enabled.

Overview
Adds Dependabot via .github/dependabot.yml so dependency maintenance is automated with explicit guardrails.

GitHub Actions get weekly grouped PRs (up to 5 open) to bump SHA-pinned actions and their inline # vX comments. Cargo is limited to security advisories only—open-pull-requests-limit: 0 blocks routine version bumps while still allowing grouped security updates. Python/pip is intentionally omitted so frozen requirements.txt files stay aligned with their *-gen.txt sources.

Reviewers should confirm Dependabot security updates is enabled in repo settings for the cargo security path to take effect.

^{Reviewed by Cursor Bugbot for commit 07c0de6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 07c0de6. Configure here.}

[cursor]

Composite actions missed by Dependabot

Medium Severity

The github-actions entry with directory: "/" only scans workflow files. SHA-pinned third-party actions inside local composites under .github/actions/ are never updated. Dependabot also does not raise security alerts for SHA-pinned actions, so those pins stay frozen.

 

^{Reviewed by Cursor Bugbot for commit 07c0de6. Configure here.}