fix: pin wasmtime 36.0.6 to match AOT compiler (#47)

The dependabot bump to wasmtime 36.0.7 (commit 7a88a5e) caused a version
mismatch between the runtime (built from workspace Cargo.lock) and the
hyperlight-wasm-aot CLI (installed from a pinned git rev with its own
Cargo.lock at 36.0.6).  Guest .aot files compiled with 36.0.6 cannot be
loaded by a 36.0.7 runtime.

Pin wasmtime back to 36.0.6 and exclude wasmtime/wasmtime-* from
dependabot auto-bumps — these must be updated together with the
hyperlight-wasm dependency.

Author: simongdavies

.github/dependabot.yml

@@ -11,6 +11,14 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    ignore:
+      # wasmtime (indirect, via hyperlight-wasm) must stay aligned with the
+      # hyperlight-wasm-aot CLI that compiles .aot guest binaries.  The AOT
+      # compiler is installed from a pinned git rev and uses its own Cargo.lock,
+      # so a workspace-only bump creates a version mismatch at runtime.
+      # Update wasmtime only when hyperlight-wasm itself is updated.
+      - dependency-name: "wasmtime"
+      - dependency-name: "wasmtime-*"
 
   # Rust (Python wasm backend — separate workspace)
   - package-ecosystem: "cargo"