chore: configure dependabot for GitHub Actions

[gavinsharp]

Summary

• Added dependabot.yml to check for GitHub Actions updates monthly
• Pinned actions/checkout and actions/setup-python to commit hashes (v6) with version comments
• Dependabot will propose updates while preserving commit hash pinning for security

Why

Commit hash pinning provides stronger security guarantees than tag-based pinning, preventing both accidental and malicious tag mutations. Dependabot will keep these pinned hashes up to date.

🤖 Generated with Claude Code

---

Note

Low Risk
Low risk: changes are limited to CI configuration, adding Dependabot and pinning GitHub Actions to commit SHAs without altering application/runtime code.

Overview
Adds .github/dependabot.yml to run monthly checks for github-actions updates.

Updates .github/workflows/ci.yml to pin actions/checkout and actions/setup-python to specific commit SHAs (with # v6 comments) across all jobs, replacing tag-based references.

^{Written by Cursor Bugbot for commit 45b8981. This will update automatically on new commits. Configure here.}