repo: add Dependabot for GitHub Actions and future dependencies #15

Summary

Add .github/dependabot.yml (or dependabot config) to auto-update GitHub Actions pins (and Cargo deps when any added) with PRs, following common practice and corinth (which likely has or benefits from it given many pinned SHAs).

Motivation

• Keeps action versions fresh (security patches) without manual toil.
• With full SHAs in CI, dependabot can still propose updates (or we update SHAs manually + it helps discover).
• Good hygiene for any future [dependencies].
• Org consistency.

Scope

• Create .github/dependabot.yml with updates for github-actions (weekly or monthly), schedule, assignees/labels.
• Optional: cargo ecosystem if deps appear.
• README or AGENTS note if relevant.
• May combine with the harden PR or separate.

Non-goals

• NO auto merge, only I will do it manually. (user explicit).
• Docker or other ecosystems yet.

Acceptance Criteria

• .github/dependabot.yml present and valid.
• First dependabot PRs created (or verified config) for actions.
• Cross refs in the file or issue to ci harden + Add Azure Pipelines for cross-platform CI verification (macOS, Windows, Linux) #8/Add Docker workflow for reproducible / containerized builds (publish to GHCR on main) #9.
• Labels "dependencies" / "ci" applied by bot.

Open Questions

• Update interval (weekly for actions)?
• Group updates?

Related

• Harden/enhance CI issue (pinned SHAs + dependabot complement)
• Add Azure Pipelines for cross-platform CI verification (macOS, Windows, Linux) #8 Add Docker workflow for reproducible / containerized builds (publish to GHCR on main) #9
• corinth-canal (actions usage)

Drafted and planned with assistance from Grok Build (xAI) for Limen-Neural/engram-parser (2026-07-03). Cite as Grok Build when creating.