ci(deps): consolidate dependabot npm entries for root (#3014)

Dependabot does not support two `package-ecosystem: npm` entries that
share the same directory + target-branch. The split introduced in #2968
was silently broken: no `npm-toolchain-deps` PR was ever opened, and
toolchain packages still leaked into `npm-prod-deps` with a `chore`
prefix instead of the intended `fix`. Collapse to a single npm entry
for `/` so the configured prefixes (`fix` for prod, `chore` for dev)
actually take effect; PR titles can be overridden manually for
toolchain-only bumps that shouldn't trigger a release.

Author: saikumarrs

.github/dependabot.yml

@@ -17,10 +17,12 @@ updates:
         patterns:
           - "*"
 
-  # Runtime (shipped) prod deps + dev deps for the monorepo root.
+  # All deps for the monorepo root (prod + dev, including toolchain).
   # Prod bumps are committed as `fix(deps):` so the release pipeline's conventional-commit
-  # analyzer picks them up and bumps the packages that consume them (dev bumps stay as chore).
-  # Toolchain packages (@nx/*, @rollup/rollup-*, @swc/core-*) are excluded here and handled below.
+  # analyzer picks them up and bumps the packages that consume them; dev bumps stay as `chore`.
+  # Override the PR title manually when a bump shouldn't trigger a release (e.g. toolchain-only).
+  # Note: Dependabot does not allow two npm entries for the same directory + target-branch,
+  # so per-group commit prefixes are not possible — keep this as a single entry.
   - package-ecosystem: "npm"
     cooldown:
       default-days: 5
@@ -38,10 +40,6 @@ updates:
       prefix: "fix"
       prefix-development: "chore"
       include: "scope"
-    ignore:
-      - dependency-name: "@nx/*"
-      - dependency-name: "@rollup/rollup-*"
-      - dependency-name: "@swc/core-*"
     groups:
       npm-dev-deps:
         patterns:
@@ -63,37 +61,6 @@ updates:
           - "major"
         dependency-type: "production"
 
-  # Build toolchain packages — Nx (JS tooling + native runners) and Rollup/SWC native
-  # binaries. None of these ship in published bundles, so bumps are committed as
-  # `chore(deps):` and intentionally skipped by the release analyzer.
-  - package-ecosystem: "npm"
-    cooldown:
-      default-days: 5
-    directory: "/"
-    schedule:
-      interval: "cron"
-      # every wednesday at 00:01 UTC
-      cronjob: "1 0 * * 3"
-      timezone: "UTC"
-    target-branch: "develop"
-    labels:
-      - "dependencies"
-      - "toolchain"
-    open-pull-requests-limit: 5
-    commit-message:
-      prefix: "chore"
-      include: "scope"
-    allow:
-      - dependency-name: "@nx/*"
-      - dependency-name: "@rollup/rollup-*"
-      - dependency-name: "@swc/core-*"
-    groups:
-      npm-toolchain-deps:
-        patterns:
-          - "@nx/*"
-          - "@rollup/rollup-*"
-          - "@swc/core-*"
-
   # All sample applications managed together (excluding gatsby)
   - package-ecosystem: "npm"
     cooldown: