chore: automate safe Dependabot updates

[sadjow]

Summary

• require frozen installs for both the root and playground Yarn lockfiles
• run CI for pull requests and require both Node 20 and Node 22 matrix checks
• assign and request review from sadjow on Dependabot updates
• enable routine npm/Yarn version updates with at most five open PRs
• apply release-age cooldowns: 7 days for patches/default, 14 for minors, and 30 for majors
• auto-approve and enable squash auto-merge only for patch and minor Dependabot updates
• leave major updates and failed CI for manual review
• let security updates bypass cooldown, as GitHub requires, while retaining CI gates
• persist repository auto-merge and strict branch-protection settings

Validation

• actionlint on both changed workflows
• Prettier and YAML parsing on all changed configuration
• explicit validation of cooldown fields and GitHub-supported 1–90 day ranges
• frozen root and playground installs
• lint, root build, playground build, and 22 unit tests on Node 22
• lint, build paths, and 22 unit tests on Node 20

The full integration suite runs in the required GitHub Actions matrix.

[Copilot]

Pull request overview

Automates guarded Dependabot updates while strengthening CI and branch protection.

Changes:

• Adds Dependabot scheduling, cooldowns, ownership, and auto-merge automation.
• Enforces frozen installs and Node 20/22 CI checks.
• Enables auto-merge and strict required status checks.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
.github/workflows/main.yml	Expands and hardens CI validation.
.github/workflows/dependabot-auto-merge.yml	Automates eligible Dependabot merges.
.github/settings.yml	Configures auto-merge and branch protection.
.github/dependabot.yml	Defines dependency update policy.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.