chore: configure low-noise dependency updates

[AmagiDDmxh]

Why

The first Dependabot version-update configuration was paused in #440 after its initial run opened ten PRs, including upgrades against an intentionally pinned native dependency. The useful part of dependency automation can be restored with much tighter volume and scope.

What changed

• Run npm/pnpm workspace version updates monthly instead of weekly.
• Limit open version-update PRs to two.
• Group all eligible patch updates into one reviewable lockfile diff.
• Suppress automatic minor and major version updates so framework/runtime migrations remain manual changes with their own validation.
• Ignore better-sqlite3 at every version because its exact pin participates in the Node/Electron ABI switching scheme.
• Allow type-package and ACP patch updates back into the monthly group. The ACP SDK and Claude extension have independent version lines; the Codex extension's exact-version platform packages are reviewed together in the grouped lockfile diff.
• Document the policy and the additional packaged-app gates required for Electron/native changes.

Dependabot security alerts remain available independently. As with any Dependabot ignore rule, an automated security-fix PR for the explicitly ignored better-sqlite3 package may be suppressed; its alert still requires manual review.

Verification

• Parsed .github/dependabot.yml with Ruby/Psych.
• Ran a semantic policy check confirming:
  • monthly cadence;
  • open PR limit of two;
  • one version-updates patch-only group;
  • global minor/major suppression;
  • better-sqlite3 as the only permanent package ignore.
• git diff --check passed.
• Ubuntu unit, Ubuntu E2E, and macOS E2E passed in PR CI.