Add Dependabot for dependency updates

[timhaines]

Small quality-of-life PR. Dependabot's security updates already run here (e.g. #852, bumping setuptools) — but with no committed config there's no cooldown, no GitHub Actions coverage, and nothing guarding your deliberate version caps. This adds a .github/dependabot.yml for that controlled layer, alongside the existing pre-commit.ci hook autoupdates.

A few light defaults:

• uv version updates, ungrouped — one PR per package (capped at 5/week) — so each can be reviewed and reverted on its own. There's no pull_request workflow in the repo today, so these arrive on review rather than a green check; ungrouped is what keeps that review tractable, and it's easy to switch to groups: later if the volume annoys you.
• npm version updates for the local-viewer SPA (strix/viewer/frontend) — the tree's second package ecosystem — same shape as uv.
• GitHub Actions grouped into one weekly PR (security updates don't cover these). This composes with the SHA pinning in Pin release-workflow actions to commit SHAs + least-privilege token #862 rather than fighting it: when an action is pinned to a commit SHA with a trailing # vX.Y.Z comment, Dependabot bumps both the SHA and the comment, so the pins stay pins and just move forward. Order doesn't matter — whichever lands second picks up the other.
• A short 7-day cooldown so a release ages before a PR opens — a light guard against pulling a freshly-compromised version. Cooldown applies only to version updates, never to security updates, so your security fixes still land immediately; cryptography is excluded too.
• Respects your deliberate version caps via ignore rules so Dependabot won't propose bumps past them: cryptography (<49, fix(deps): cap cryptography <49 to keep Intel macOS universal2 wheel #859), openai (<2.45, fix(deps): cap openai<2.45 and add litellm[proxy] so fresh installs can run #748), and the openai-agents ==0.14.6 migration pin. In-range patch/minor updates below each cap still flow. (The openai-agents pin is the one most worth a second look — drop that entry if you'd rather be nudged when a new SDK release lands.)

There's also a commented-out docker entry for the sandbox image, ready to enable once its base is pinned off :latest.

The cooldown here is the updater layer. The matching resolver-layer cooldowns — so manual/local updates age too — are in #861 (uv) and #864 (npm).

To activate: merging doesn't start it on its own — enable it once under Settings → Code security → Dependabot → Dependabot version updates. Runs then show under Insights → Dependency graph → Dependabot (first PRs arrive on the weekly schedule).

[greptile-apps]

Greptile Summary

This PR adds controlled Dependabot version updates across the repository.

• Weekly ungrouped updates for Python dependencies managed by uv.
• Weekly ungrouped updates for the local-viewer npm dependencies.
• Grouped weekly updates for GitHub Actions.
• Seven-day cooldowns and ignore rules for deliberate Python version caps.
• A disabled Docker updater template for future use.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
.github/dependabot.yml	Adds weekly uv, npm, and GitHub Actions update rules with cooldowns, limits, grouping, and protected Python version caps.

_{Reviews (2): Last reviewed commit: "Add npm ecosystem for the local-viewer f..." | Re-trigger Greptile}

[timhaines]

@greptile