Automate pi-mono dependency update PRs with patch health checks

[pmateusz]

Motivation

We need an automated way to detect new @earendil-works/* pi-mono package versions and open update PRs for kimchi.

Today, pi-mono dependencies are version-pinned and several of them have matching pnpm.patchedDependencies entries plus patch files under patches/. When a pi-mono package is updated, the dependency version, patched dependency key, lockfile, and patch file can drift out of sync. That can break pnpm install or leave patch updates to be discovered manually.

Proposed solution

This issue tracks adding automation that:

• Detects available minor/patch updates for @earendil-works/* packages.
• Opens grouped PRs for pi-mono updates.
• Ensures patch files and pnpm.patchedDependencies remain in sync.
• Runs a patch health check before install so failures are clear.
• Runs enough CI validation to confirm the updated pi-mono packages still work with kimchi.

Acceptance criteria:

• Dependabot or equivalent automation opens PRs for @earendil-works/* minor/patch updates.
• Related pi-mono package updates are grouped into a single PR.
• CI fails clearly when a patch entry or patch file is stale.
• The update PR validates install, patch health, unit tests, and dry-run release behavior.
• The workflow does not publish release artifacts from dependency update PRs.

Alternatives considered

No response