ci: enable Dependabot version updates for GitHub Actions

[swkeever]

Summary

Part of VOL-1094 (epic VOL-1077). volcano-skills had no Dependabot config, so its SHA-pinned actions only moved when someone bumped them by hand. This adds .github/dependabot.yml.

• github-actions is the only ecosystem. The skills are Markdown, and scripts/ and tests/ use Node built-ins only, so there are no package manifests or lockfiles to watch.
• Covers /, which is .github/workflows (there are no composite actions under .github/actions).
• Runs weekly with open-pull-requests-limit: 5 and a 5-day cooldown (Actions supports default-days only).
• Minor and patch updates are grouped into one PR, and each major gets its own PR.
• Known Dependabot limitation: majors only get individual PRs on runs where the group has no open PR (dependabot-core#14202; the fix, #16113, is still open). Merging the group PR lets majors through. Upstream reports no config workaround, and the config comments say so.
• Titles are ci(deps): …, matching the repo's Conventional Commits history.
• Labels: this repo has no dependency labels, so labels: [] stops Dependabot creating its defaults.
• Sync safety: volcano-agentic-plugins' sync-skills-from-source.mjs excludes .github/, so this file is never copied into the plugin skill folders and won't trip their drift check.

Status (read-only, not changed here)

• Dependabot alerts and security updates are both enabled, with 0 open alerts.

Validation

• check-jsonschema --schemafile https://json.schemastore.org/dependabot-2.0.json .github/dependabot.yml: ok.
• Sample titles (ci(deps): bump the github-actions group with 2 updates, ci(deps): bump actions/checkout from 4.4.0 to 6.0.0) pass commitlint config-conventional.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[CLAassistant]

All committers have signed the CLA.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[swkeever]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-07T14:00:40.058133Z	6885eb4	Manual request
🔒 Security Review	✅ Completed 2026-10-07T14:01:24.773499Z	6885eb4	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: aed955de0a

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: aed955de0a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[swkeever]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🚀

Reviewed commit: 6885eb4d53

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: 6885eb4d53

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.