chore: add dependabot.yml (pip / github-actions / docker)

[cmeans-claude-dev]

Replaces #18. Original PR closed due to a CreateEvent leak under the v1 bot-push design (the first push of chore/dependabot-config was attributed to cmeans instead of the bot, which would block merge under require_last_push_approval once cmeans approves). The v2 design that prevents this class of leak landed in cmeans/claude-dev#4; this replacement branch was created under v2 so the CreateEvent actor is cmeans-claude-dev[bot]. Branch contents identical (same commit cherry-picked).

---

Summary

Replaces the GitHub starter skeleton with a real Dependabot config tailored to this repo. Tracks weekly version updates across the three ecosystems present in tree:

• pip at / — pyproject.toml + uv.lock (PyYAML, pypinfo, and the dev extras: pytest, pytest-cov, ruff, mypy, types-PyYAML).
• github-actions at / — workflow files under .github/workflows/ (CI matrix, publish workflows, label automation).
• docker at /deploy/docker — Dockerfile base image for the optional containerized deployment shape.

Schedule is weekly, Monday 06:00 America/Chicago — keeps PR volume manageable for a solo project. Each ecosystem groups its updates into a single weekly PR (instead of one PR per dep) to keep notification noise down.

Labels (dependencies plus a per-ecosystem qualifier) are applied only if those labels already exist; Dependabot does not auto-create labels. The label-automation workflows continue to drive the QA-flow labels separately.

CHANGELOG entry omitted — repo infrastructure, not a user-visible product change (consistent with how PR #17's community-health files are landing).

Test plan

• After merge, Dependabot should post an "Initial setup" PR within ~10 min (or on the next Monday at 06:00 CT) — verify it lands and runs the normal CI matrix.
• Confirm Settings → Code security and analysis → Dependabot shows version updates as enabled.
• Confirm the three ecosystems are recognized — visit Insights → Dependency graph → Dependabot and check each shows last-updated timestamps.
• First-week PRs apply the configured labels (or, if any of dependencies/python/github-actions/docker aren't yet defined, the missing labels are silently skipped — this is expected and not a regression).
• Generated commit messages start with chore(deps) prefix.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[cmeans]

QA round 1 (v2 branch) — clean

Tree-equality check: git diff chore/dependabot-config chore/dependabot-config-v2-qa is empty. v2 is bit-identical to v1 head e76896e; only the CreateEvent attribution differs.

Static verification on head 955ac5c:

Check	Result
YAML parses (yaml.safe_load)	OK — version: 2, three ecosystems
Ecosystem coverage	complete — no other manifests in tree (requirements.txt/Pipfile/package.json/etc.) and no composite actions under .github/actions/
pip directory /	pyproject.toml + uv.lock present
github-actions directory /	.github/workflows/ has 6 files (ci, pr-labels, pr-labels-ci, publish, test-publish, qa-gate)
docker directory /deploy/docker	Dockerfile present (two FROM python:3.13-slim stages — same image, one weekly PR even without an explicit groups: block, so the omission is fine)
Schedule (all 3 ecosystems)	weekly Monday 06:00 America/Chicago — matches PR body
commit-message.prefix	chore(deps) on all three — matches PR body item 5
groups: "*" on pip + github-actions	will fold per-ecosystem updates into one weekly PR each, as advertised
CI on PR head	all SUCCESS (test 3.11/3.12/3.13, lint, typecheck, on-push, qa-approved)

Label state on the repo (verified via gh label list): dependencies ✅ exists; python, github-actions, docker ❌ missing. Dependabot will silently skip the missing per-ecosystem qualifiers — exactly the behavior the PR body and test-plan item 4 explicitly call "expected and not a regression." Not a finding; just confirming the runtime state matches the documented assumption. Creating the three remaining labels is already on the maintainer's repo-setup follow-up list.

Test-plan checkboxes: all five items are post-merge runtime checks (Dependabot PR generation, Insights/Dependency-graph rendering, first-week PR labels, generated commit messages). None are tickable pre-merge — leaving all five unchecked for the maintainer.

No findings. Transitioning label to Ready for QA Signoff.

[cmeans]

Applying Ready for QA Signoff — see review above. Static verification all green on 955ac5c, v2 tree-identical to v1 e76896e, no findings. All five test-plan items are post-merge runtime checks for the maintainer.

[cmeans]

LGTM