chore(dependabot): keep Python 3.12 for MCP + ClickHouse Docker images

- Ignore python major/minor bumps and explicit 3.13–3.16-slim tags
- Document policy in Dockerfiles; closes path to 3.14 PR noise

Made-with: Cursor

Author: pamosima

.github/dependabot.yml

@@ -59,6 +59,7 @@ updates:
       - "security"
       - "docker"
 
+  # Stay on Python 3.12 for MCP + exporter; block Dependabot PRs to 3.13/3.14+ until explicitly upgraded.
   - package-ecosystem: "docker"
     directory: "/netops-mcp-server"
     schedule:
@@ -68,6 +69,11 @@ updates:
       - "dependencies"
       - "security"
       - "docker"
+    ignore:
+      - dependency-name: "python"
+        update-types: ["version-update:semver-major", "version-update:semver-minor"]
+      - dependency-name: "python"
+        versions: ["3.13-slim", "3.14-slim", "3.15-slim", "3.16-slim"]
 
   - package-ecosystem: "docker"
     directory: "/clickhouse"
@@ -78,3 +84,8 @@ updates:
       - "dependencies"
       - "security"
       - "docker"
+    ignore:
+      - dependency-name: "python"
+        update-types: ["version-update:semver-major", "version-update:semver-minor"]
+      - dependency-name: "python"
+        versions: ["3.13-slim", "3.14-slim", "3.15-slim", "3.16-slim"]

clickhouse/Dockerfile.export-syslog-metrics

@@ -1,4 +1,5 @@
 # ClickHouse → Prometheus exporter (queries default.syslog, exposes :9099/metrics)
+# Policy: Python 3.12 only (see .github/dependabot.yml).
 # Pinned index digest (docker buildx imagetools inspect python:3.12-slim)
 FROM python:3.12-slim@sha256:7026274c107626d7e940e0e5d6730481a4600ae95d5ca7eb532dd4180313fea9
 WORKDIR /app

netops-mcp-server/Dockerfile

@@ -1,4 +1,5 @@
 # NetOps MCP Server — reproducible install via uv.lock; non-root runtime
+# Policy: Python 3.12 only (Dependabot ignores 3.13+ for this image).
 # Pinned index digest (docker buildx imagetools inspect python:3.12-slim)
 FROM python:3.12-slim@sha256:7026274c107626d7e940e0e5d6730481a4600ae95d5ca7eb532dd4180313fea9 AS builder