ci: code coverage nativo (Cobertura) + dependabot (gomod/actions/docker)

- go-cli.yml: convierte coverage.out a Cobertura XML y lo sube con
  actions/upload-code-coverage (feature nativa Code Quality de GitHub),
  con permiso code-quality: write.
- dependabot.yml: updates semanales para gomod, github-actions y docker.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: aledbf

.github/dependabot.yml

@@ -0,0 +1,27 @@
+version: 2
+updates:
+  # Go modules (go.mod / go.sum en la raíz)
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      go-dependencies:
+        patterns:
+          - "*"
+
+  # GitHub Actions usadas en .github/workflows
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      actions:
+        patterns:
+          - "*"
+
+  # Imagen base del Dockerfile
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/go-cli.yml

@@ -9,6 +9,9 @@ on:
 jobs:
   lint-and-test:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      code-quality: write
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
@@ -23,6 +26,20 @@ jobs:
       - run: task test:integration
       - run: task build
       - run: ./devcontainer --version
+
+      # Convierte el perfil de Go (coverage.out) a Cobertura XML para la
+      # feature nativa de Code Quality de GitHub.
+      - name: Convert coverage to Cobertura XML
+        run: |
+          go install github.com/boumenot/gocover-cobertura@latest
+          gocover-cobertura < coverage.out > coverage.xml
+      - name: Upload coverage report
+        uses: actions/upload-code-coverage@v1
+        with:
+          file: coverage.xml
+          language: Go
+          label: code-coverage/go
+
       - uses: actions/upload-artifact@v4
         if: always()
         with: