chore: Fix/dependabot and ci

[anchildress1]

This pull request includes several configuration and script updates aimed at improving workflow consistency, error handling, and dependency management. The most important changes are grouped below by theme.

Workflow and Dependency Management:

• Changed the dependency installation step in .github/workflows/security-ci.yml to use uv lock instead of uv sync --locked --group dev, ensuring a more consistent lock file generation.
• Updated the commit message prefix for Dependabot updates from "deps" and "deps-dev" to "chore" in .github/dependabot.yml, standardizing commit message conventions.

Script Error Handling:

• Modified the cleanup() and main() functions in .specify/scripts/bash/update-agent-context.sh to use return instead of exit, improving error handling and script composability. [1] [2]

Release Configuration:

• Moved the include-component-in-tag property from the root to the package-specific section in release-please-config.json, clarifying configuration scope and ensuring proper tagging behavior for the Python package.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Updates automation configuration (Dependabot, CI, Release Please) and improves the composability of an internal bash script used for updating agent context files.

Changes:

• Adjust Dependabot commit message prefixing to align with conventional commits.
• Modify security CI dependency setup to use uv lock before running make install.
• Simplify release-please-config.json by consolidating settings under the packages entry and adjust script exit/return behavior in update-agent-context.sh.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
release-please-config.json	Moves include-component-in-tag under the . package configuration.
.specify/scripts/bash/update-agent-context.sh	Switches exit to return in cleanup and main for better composability.
.github/workflows/security-ci.yml	Changes dependency step to run uv lock before make install.
.github/dependabot.yml	Updates Dependabot commit message prefix to chore.

Comments suppressed due to low confidence (1)

.specify/scripts/bash/update-agent-context.sh:124

• cleanup is registered for INT/TERM as well as EXIT, but it now uses return. For INT/TERM, returning from the trap handler suppresses the default signal behavior and the script will continue running after Ctrl+C / termination signals. If the goal is to avoid killing the parent shell when sourced, consider conditionally exit when executed directly and return when sourced (or keep exit for INT/TERM and only return for EXIT).

cleanup() {
    local exit_code=$?
    rm -f /tmp/agent_update_*_$$
    rm -f /tmp/manual_additions_$$
    return $exit_code
}

# Set up cleanup trap
trap cleanup EXIT INT TERM

[Copilot]

uv lock generates/updates uv.lock but does not install dependencies. In CI this makes the environment non-reproducible (it can resolve newer versions than what’s committed) and is redundant since make install already runs uv sync --locked --group dev. Prefer removing uv lock here, or replace it with a non-mutating validation like uv lock --locked if you want to assert the lockfile is up to date.

Suggested change

uv lock