Add Dependabot policy rendering

[pheidon]

Summary

• add manifest-backed Dependabot policy defaults
• render .github/dependabot.yml with weekly npm and GitHub Actions update checks
• group npm minor/patch updates and keep major updates manual by default

Governing Issue

No issue is linked; this implements JT's Telegram request to put the Dependabot operating shape into Bootstrap.

Validation

• npm test -- --update
• npm run check
• npm run build
• npm run dev -- plan --manifest ./project.bootstrap.yaml --target .

Bootstrap Governance

• Manifest remains the source of truth for the generated policy
• Generated file is scoped to scheduled version updates; GitHub security settings remain responsible for Dependabot alerts/security updates
• Major updates remain manual by default

Merge Automation

• Auto-merge is enabled; GitHub will merge once review/check gates permit it

Notes

This intentionally separates Dependabot security updates from routine version updates: security stays enabled through repository/org settings, while the generated dependabot.yml handles scheduled ecosystem update PRs.