Fix red CI: re-lock uv.lock to 0.8.6 + drop broken npm Dependabot stanza

.claude/skills/release-bully/SKILL.md

@@ -24,12 +24,12 @@ Bully is a Claude Code plugin. Claude Code detects updates by comparing the `ver
 | `.claude-plugin/marketplace.json` | root | `metadata.version` |
 | `.claude-plugin/marketplace.json` | first plugin entry | `plugins[0].version` |
 | `pyproject.toml` | `[project]` table | `version` |
-| `pipeline/pipeline.py` | top of file | `BULLY_VERSION = "..."` (stamped into `session_init` telemetry records) |
+| `src/bully/__init__.py` | top of file | `BULLY_VERSION = "..."` (stamped into `session_init` telemetry records) |
 
 Drift between these is the most common release bug. Grep to verify after editing:
 
 ```bash
-grep -RnE '"version"|^version|^BULLY_VERSION' .claude-plugin/ pyproject.toml pipeline/pipeline.py
+grep -RnE '"version"|^version|^BULLY_VERSION' .claude-plugin/ pyproject.toml src/bully/__init__.py
 ```
 
 All five lines must show the new version.
@@ -70,7 +70,15 @@ Use `Edit` (not `sed`) to update each file. Exact new string in every case: `X.Y
 
 For `marketplace.json`, there are two occurrences — bump both.
 
-For `pipeline/pipeline.py`, update the `BULLY_VERSION = "X.Y.Z"` constant near the top. This value gets stamped into every `session_init` telemetry record, so it must match the released version exactly.
+For `src/bully/__init__.py`, update the `BULLY_VERSION = "X.Y.Z"` constant near the top. This value gets stamped into every `session_init` telemetry record, so it must match the released version exactly.
+
+Then re-lock so `uv.lock` records the new project version:
+
+```bash
+uv lock
+```
+
+The editable `bully` package's version in `uv.lock` is derived from `pyproject.toml`, so bumping `pyproject.toml` without re-locking leaves the lock stale. CI runs `uv sync --locked --all-extras`, which hard-fails on a stale lock ("The lockfile at `uv.lock` needs to be updated, but `--locked` was provided"). The re-locked `uv.lock` must be part of the release commit.
 
 ### 4. Rewrite CHANGELOG.md
 
@@ -104,16 +112,16 @@ If the `[Unreleased]` section is empty or placeholder-only, derive entries from
 ### 5. Verify before committing
 
 ```bash
-grep -RnE '"version"|^version|^BULLY_VERSION' .claude-plugin/ pyproject.toml pipeline/pipeline.py
+grep -RnE '"version"|^version|^BULLY_VERSION' .claude-plugin/ pyproject.toml src/bully/__init__.py
 git diff
 ```
 
-All five version lines must show `X.Y.Z`. Diff should touch only the five version fields and `CHANGELOG.md`. If anything else changed, abort.
+All five version lines must show `X.Y.Z`. Diff should touch only the five version fields, `uv.lock` (the re-lock from §3), and `CHANGELOG.md`. If anything else changed, abort.
 
 ### 6. Commit, tag, push
 
 ```bash
-git add .claude-plugin/plugin.json .claude-plugin/marketplace.json pyproject.toml pipeline/pipeline.py CHANGELOG.md
+git add .claude-plugin/plugin.json .claude-plugin/marketplace.json pyproject.toml src/bully/__init__.py uv.lock CHANGELOG.md
 git commit -m "Release v0.2.0"
 ```
 
@@ -151,6 +159,7 @@ Report: version bumped, tag pushed, release URL (from `gh release create` output
 | `gh release create` before `git push origin <tag>` | Push the tag first; `gh release create` needs it on the remote. |
 | Picked patch when a breaking change landed | Re-read commits. If users need to edit their `.bully.yml` or re-wire hooks, it's major. |
 | Committed with uncommitted unrelated changes | Stash them first. The release commit must be version + changelog only. |
+| Bumped the version but forgot `uv lock` | CI's `uv sync --locked` fails on the stale lock. Re-lock (§3) and include `uv.lock` in the release commit. |
 
 ## Abort criteria
 

.github/dependabot.yml

@@ -41,12 +41,6 @@ updates:
     cooldown:
       default-days: 2
 
-  # No package.json today; this stanza is a no-op until one lands at the repo
-  # root. Listed so the cooldown policy is uniform if/when node tooling is added.
-  - package-ecosystem: npm
-    directory: /
-    schedule:
-      interval: weekly
-    open-pull-requests-limit: 5
-    cooldown:
-      default-days: 2
+  # No npm ecosystem: there is no package.json at the repo root, and Dependabot
+  # hard-errors ("dependency_file_not_found") rather than no-op'ing on a missing
+  # manifest. Add an `npm` stanza here only once a root package.json actually lands.