chore(deps): add dependabot configuration for example packages (#200)

Adds Dependabot monitoring for all four example package directories and fixes the Verify Package Coverage workflow to support non-workspace packages.

Changes:
- Added Dependabot npm configs for examples/cjs-consumer, examples/esm-consumer, examples/typescript-cjs-consumer, and examples/typescript-esm-consumer
- Each example has weekly updates, lower PR limit (5), and 'examples' label
- TypeScript examples include @types/node pinning (v20.x)
- Updated Verify Package Coverage workflow to recognize individual Dependabot configs in addition to workspace packages

The example packages are test fixtures for package compatibility verification that need dependency updates to stay current but are intentionally not part of the main workspace.

Author: groupsky

.github/dependabot.yml

@@ -119,3 +119,69 @@ updates:
       # Note: Security updates are not grouped - they create immediate individual PRs
     open-pull-requests-limit: 10
     rebase-strategy: 'auto'
+
+  # Example packages - test fixtures for package compatibility
+  - package-ecosystem: 'npm'
+    directory: '/examples/cjs-consumer'
+    schedule:
+      interval: 'weekly'
+      day: 'monday'
+      time: '03:00'
+    labels:
+      - 'dependencies'
+      - 'npm'
+      - 'examples'
+    commit-message:
+      prefix: 'chore(deps)'
+      include: 'scope'
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: 'npm'
+    directory: '/examples/esm-consumer'
+    schedule:
+      interval: 'weekly'
+      day: 'monday'
+      time: '03:00'
+    labels:
+      - 'dependencies'
+      - 'npm'
+      - 'examples'
+    commit-message:
+      prefix: 'chore(deps)'
+      include: 'scope'
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: 'npm'
+    directory: '/examples/typescript-cjs-consumer'
+    schedule:
+      interval: 'weekly'
+      day: 'monday'
+      time: '03:00'
+    labels:
+      - 'dependencies'
+      - 'npm'
+      - 'examples'
+    commit-message:
+      prefix: 'chore(deps)'
+      include: 'scope'
+    # Pin @types/node to v20.x to match minimum supported Node.js version
+    ignore:
+      - dependency-name: '@types/node'
+        update-types: ['version-update:semver-major']
+        versions: ['>=21']
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: 'npm'
+    directory: '/examples/typescript-esm-consumer'
+    schedule:
+      interval: 'weekly'
+      day: 'monday'
+      time: '03:00'
+    labels:
+      - 'dependencies'
+      - 'npm'
+      - 'examples'
+    commit-message:
+      prefix: 'chore(deps)'
+      include: 'scope'
+    open-pull-requests-limit: 5

.github/workflows/dependabot-verify.yml

@@ -66,7 +66,10 @@ jobs:
             echo "   Root configuration covers all workspace packages"
             echo ""
 
-            # Verify all packages are in workspace
+            # Extract all dependabot directories for checking
+            dependabot_dirs=$(grep -A 1 "package-ecosystem: 'npm'" "$config_file" | grep "directory:" | awk '{print $2}' | tr -d "'")
+
+            # Verify all packages are covered (either in workspace or have individual config)
             coverage_ok=true
             for pkg in $packages; do
               pkg_dir=$(dirname "$pkg")
@@ -77,8 +80,11 @@ jobs:
                 # Check if package is in workspace
                 if echo "$has_workspaces" | jq -e --arg dir "$pkg_dir" 'any(. == $dir or . == ($dir | split("/")[0] + "/*"))' >/dev/null 2>&1; then
                   echo "✅ $pkg_dir is covered (workspace)"
+                # Check if package has individual dependabot config
+                elif echo "$dependabot_dirs" | grep -q "^/$pkg_dir$"; then
+                  echo "✅ $pkg_dir is covered (individual config)"
                 else
-                  echo "❌ $pkg_dir is NOT in workspace configuration!"
+                  echo "❌ $pkg_dir is NOT covered!"
                   coverage_ok=false
                 fi
               fi