Dependabot: manage Python deps via uv ecosystem; retire broken uv-upgrade bot (closes #416) (#496)

* Dependabot: cover Python deps (uv); retire the broken uv-upgrade bot

dependabot.yml only watched github-actions, so Python dependencies were
unmanaged by Dependabot. The home-grown uv-upgrade.yml bot filled that gap
but its PRs can never trigger CI (GITHUB_TOKEN-opened PRs don't fire
workflows), so branch protection blocked them indefinitely (#416).

Add the `uv` package-ecosystem to dependabot.yml (grouped into one PR) and
remove uv-upgrade.yml. Dependabot-opened PRs run CI normally and it manages
uv.lock natively. Closes #416.

GitHub-settings security is already on (Dependabot alerts + security updates,
secret scanning, push protection); this fills the version-update gap.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Fix dependabot.yml comment to match grouped behavior

The python-deps group batches all updates into one PR; the comment
incorrectly said per-dependency PRs (Copilot review). Grouping is intended
(mirrors the old bulk uv-upgrade, less noise).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: turbomam

.github/dependabot.yml

@@ -1,7 +1,25 @@
 version: 2
 updates:
+  # GitHub Actions workflow dependencies
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 5
+
+  # Python dependencies (uv / pyproject.toml + uv.lock).
+  # Replaces the home-grown uv-upgrade.yml bot, whose PRs could never trigger
+  # the required CI checks (GITHUB_TOKEN-opened PRs do not fire workflows), so
+  # branch protection blocked them forever (#416). Dependabot-opened PRs do run
+  # CI. The `python-deps` group batches all Python updates into a single weekly
+  # PR (mirroring the old bot's bulk `uv lock --upgrade`, with less PR noise
+  # than per-dependency PRs).
+  - package-ecosystem: "uv"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    groups:
+      python-deps:
+        patterns:
+          - "*"