Tidy Dependabot config: drop dead npm ecosystem and group github-actions updates

[Justus-at-Tazama]

Summary

Dependabot is generating noise in frmscoe/workflows. The repo's .github/dependabot.yml was seeded from the stock "every TS repo" baseline template, which is written for an npm/TypeScript service. In a workflows-only repo that produces two problems:

1. Dead npm ecosystem block. The config declares a package-ecosystem: "npm" updater at /, but this repo has no package.json (root is .codacy.yml, .github, .markdownlint.json, README.md, config-templates, workflow-docs). The npm updater has no manifest to act on - it is pure dead config.

2. Ungrouped github-actions updates create PR spam. The github-actions updater is legitimately in scope (this repo is now the central home of the reusable *-ci.yml workflows after the stub-architecture migration, so it carries the action pins for the whole fleet). But with no groups: set, Dependabot opens one PR per action. That is currently 5 open PRs (build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 #92 setup-node, build(deps): bump anchore/sbom-action from 0.11.0 to 0.24.0 #93 sbom-action, build(deps): bump hadolint/hadolint-action from 2.1.0 to 3.3.0 #94 hadolint-action, build(deps): bump github/codeql-action from 3.35.1 to 4.36.0 #95 codeql-action, build(deps): bump actions/setup-node from 6.3.0 to 6.4.0 #96 upload-artifact) and will keep recurring monthly.

Why this surfaced now

The central migration (PR #100) moved all reusable *-ci.yml workflows into this repo. Those reusables hold the uses: <action>@<version> pins for the entire member fleet, so Dependabot's action refs concentrated here and opened a batch.

Current config

version: 2
updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "monthly"
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"

Proposed fix

• Remove the npm ecosystem block (no manifest exists in this repo).
• Add a groups: key to the github-actions updater so all action bumps land in a single weekly/monthly PR instead of one-per-action.

Example:

version: 2
updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "monthly"
    groups:
      github-actions:
        patterns:
          - "*"

Scope note

.github/dependabot.yml is a per-repo baseline file, not delivered by sync-workflows.yml, so it must be edited directly in this repo (it is not overwritten by the sync). The same stray npm block very likely exists in tazama-lf/workflows and in the baseline template at tazama-lf/docs/templates/common/.github/dependabot.yml - the root-cause fix belongs in the template so new repos stop inheriting it, with a follow-up sweep of any workflows/non-npm repos already seeded from it.