security: add Dependabot so the SHA-pinned actions get bumped

[scttfrdmn]

Fixes #6.

The problem

All 5 uses: refs in this repo were already pinned to commit SHAs — which is exactly the situation that needs Dependabot. A SHA never moves, including past a security fix, and unlike @v5 nothing updates it. Half a control was in place: the mutable-tag hole closed, and a staleness hole left open where it had been.

Pinning and Dependabot are one control, not two. Shipping only one trades a live hole for a slow one.

Scope note, stated plainly: nothing in this repo publishes a package, so the exposure is narrower than the suite's npm/PyPI publishers. But release.yml holds contents: write to create the GitHub Release, so a compromised action in that job can write to this repo and alter published release artifacts.

The fix

1. .github/dependabot.yml covering github-actions and pip, weekly with a 7-day cooldown — a freshly published tag is exactly when a compromised or broken one is still unnoticed.
   • Group pattern is *, not actions/*: softprops/action-gh-release isn't under actions/ and would otherwise fall outside the group, which is how bumps get quietly ignored.
   • ruff >=0.16 is explicitly ignored so a Dependabot bump can't undo the deliberate <0.16 cap in pyproject.toml.
   • No reviewers: key — deprecated and inert.
2. tests/test_ci_hygiene.py makes both halves regressions instead of conventions. Reverting a pin or dropping the Dependabot entry now fails pytest -q, which CI already runs. It asserts it found >0 refs, so a parser that stops matching fails rather than passing vacuously.

pyyaml joins the [dev] extra and is imported unguarded: a try/except ImportError degrades to a skip, and a skipped wiring test reports green while asserting nothing — the exact silent no-op these tests exist to catch.

Verification

• pytest tests/test_ci_hygiene.py — 3 passed
• ruff check . — clean
• All workflow YAMLs still parse
• Mutation-tested 5 ways, each caught: unpin a ref; narrow the group pattern; remove the pip entry; delete dependabot.yml; drop a # vX.Y.Z comment. Both files verified byte-identical afterward, tests green again.

Honest note on local runs: pytest -q collects with 2 pre-existing errors on my machine because cwltool isn't installed locally — identical on unmodified main, so unrelated to this change. CI installs it via pip install -e ".[dev]".

No behaviour change — CI wiring and tests only. Part of the suite-wide sweep: libs#33/#36, spawn/truffle/lagotto/mcp, python-sdk#11, spawn-ts#73, truffle-ts#47, lagotto-ts#11, advisor-ts#7, miniwdl-spawn#7, airflow-spawn#8, snakemake-executor-plugin-spawn#8.