chore: disable dependabot version updates for the bun ecosystem

[uzayer]

The defect

The wildcard version-update:semver-major ignore does not hold for the bun ecosystem.

#145 named vite, @vitejs/plugin-react, typescript and immer explicitly after the 2026-08-10 run let those majors through. The very next run, against the merged config, opened #146 — react-resizable-panels 2.1.9 → 4.12.2 (manifest spec is ^2).

ecosystem	PRs on this config	semver-major leaked
bun	6	6
cargo	38	0

Same ignore block on both entries. Zero leaked through Cargo, all six through bun — so the wildcard isn't being applied here rather than being mis-specified. I don't have the Dependabot job logs to confirm the mechanism, and the fix doesn't depend on it.

Naming packages individually can't work: the next major is always a package nobody has listed yet.

The fix

open-pull-requests-limit: 0 on the bun entry. Per the options reference, this is the documented way to disable version updates for one package manager, and security update PRs are exempt from the limit — so vulnerability fixes still arrive automatically. Only routine version bumps stop.

The groups and ignore blocks are left in place, unused, so this is a one-line revert once bun support honours ignore.update-types.

Cargo and github-actions are untouched.

Why this is the right trade here specifically

JS breakage in this repo is invisible to CI. Per the dedupe note in vite.config.ts and CLAUDE.md, a duplicated @codemirror/* or pdfjs-dist in the production bundle silently breaks editor theming and PDF rendering while lint, typecheck, bun run build and bun run dev all stay green. The only check that catches it is bun run build:app and a real window — which no unattended bot PR can attest to.

So the frontend was never going to be safely auto-updatable in this repo regardless of the bug. Losing routine JS bump PRs costs little; being unable to stop majors costs a maintainer closing them by hand every month.

The tradeoff, stated plainly: JS minor/patch updates will now drift until someone bumps them deliberately. That's the real cost, and it's accepted knowingly.

Meanwhile, the Cargo grouping from #145 works

The two grouped PRs the new config produced:

• chore(deps): bump tokio in /crates/atlas-acp #148 — tokio across 10 Cargo.lock files in one PR (previously 6 separate PRs)
• chore(deps): bump agent-client-protocol in /crates/atlas-acp #147 — agent-client-protocol across 5 crates in one PR

Dependabot names a grouped PR after its first directory, so the titles read in /crates/atlas-acp while the diffs span every affected crate.

Verification

• Parses as valid YAML
• Validates against the official SchemaStore Dependabot v2 schema (ajv), and open-pull-requests-limit is a schema-known key rather than silently tolerated
• Confirmed by the next scheduled run — config changes can't be tested before merge