ci(dependabot): unblock workspace updates and move child manifest ranges

[mbeacom]

What and why

Two defects in .github/dependabot.yml, both found by reading what Dependabot
actually did in this repository rather than what the config looks like it says.

The bun entry already reaches packages/*. directory: "/" reads the only
lockfile the workspace has, and Dependabot edits whichever child manifest
declares the range it must widen — PR #99 bumped @types/semver, declared only
in packages/core, and the root-bun branch at d9b775c widened zod in
packages/mcp/package.json. So this adds no directories: entries. For
packages/adapters/* they would be actively harmful: spec-kit and
agent-plugin declare no dependencies by design, and packaging.test.ts
enforces it.

1. One group was batching bumps that invalidate a committed artifact with bumps that don't.

zod drives z.toJSONSchema in packages/core/src/schema/emit.ts, so bumping
it fails schema-emit.test.ts and the T090/T096 envelope-digest tests until
schema:emit is re-run. picomatch is recorded as a literal observation at
glob-compile-once.test.ts:76 (toBe('4.0.5')), so bumping it fails T063.
Grouped under patterns: ["*"], either one took every other update down with
it — which is why #200 is red on clean-clone-builds and three root-bun
branches stacked up re-proposing the same three updates.

Both now land alone, alongside the two exact pins whose versions were verified
by measurement rather than changelog: @modelcontextprotocol/* 2.0.0 (ADR-0018's
dual-era stdio dogfood) and jsonpath-rfc9535 1.3.0 (RFC 9535 semantics for
@adrkit/evaluator). The group keeps the rest and takes minor/patch only, so a
major arrives as its own reviewable PR.

2. Child manifest ranges moved inconsistently, which reads as "Dependabot never got here".

A range is rewritten only where it has the precision to show the change.
zod: ^4.2.0 became ^4.5.4, but picomatch: "^4" and @types/semver: "^7"
stayed textually put across 4.0.5 → 4.0.7 and 7.7.1 → 7.8.0, because the bumped
digits sit below the precision those ranges declare.

versioning-strategy: increase makes every child manifest move with its
dependency. Confirmed supported for this ecosystem rather than assumed to be
inherited from npm: bun/lib/dependabot/bun/update_checker.rb honours an
explicitly configured strategy and only falls back to
library? ? WidenRanges : BumpVersions when none is set. It reaches neither
workspace:* nor the latest tag on @types/bun/yaml — the updater returns
any requirement matching /^([A-Za-uw-z]|v[^\d])/ untouched.

The cost is accepted rather than unnoticed, and recorded in the file: five of
these packages are published, so narrowing ^4 to ^4.0.7 narrows what a
consumer can dedupe to, and a narrow range here is not a considered
compatibility floor.

/site and github-actions are byte-identical to main.

Checklist

• Commits are DCO signed off.
• N/A — changes no recorded decision in docs/adr/.
• N/A — no schema change.
• N/A — packages/ci/src and @adrkit/core unchanged.
• N/A — see "Notes for reviewers" on coverage.
• bun run typecheck && bun run build && bun test && bun run lint pass from
  this worktree: 2812 pass, 0 fail, lint clean.

Notes for reviewers

No test covers this file, and I did not add one. Nothing in scripts/,
.github/workflows/, or packages/*/test/ reads .github/dependabot.yml
(grepped). The config's real validator is GitHub, on push. Adding a gate that
asserts the config's shape is plausible for this repository but is a larger
decision than this PR — flagging rather than smuggling it in. Per ADR-0016 I'd
rather say that than claim coverage a check never gave.

This does not make #200 mergeable. Ungrouping isolates zod and picomatch;
it does not regenerate the artifacts they invalidate. That needs
bun run schema:emit committed and the '4.0.5' literal updated, which is
separate work. The three stale root-bun branches (d9b775c, 731707b,
24dd742) also need closing so Dependabot re-proposes under this config —
otherwise the new grouping never touches the existing backlog.

Watch the first run after merge. update-types activates
semver_rules_allow_grouping?, which excludes a dependency from the group when
either the current or latest version is not parseable semver. Previously, with
update-types unset, that check short-circuited to true for everything.

Out of scope, offered: Containerfile's base-image digests are covered by no
entry. Dependabot's docker fetcher does match the filename
(/dockerfile|containerfile/i), but both FROM lines resolve tag and digest
through ARG, and I did not verify it can update those.

[github-actions]

Decisions governing this change

No governing decisions for the changed files.

[Copilot]

🔵 Needs a closer look

The package-publication rationale has an unresolved concern requiring final human review.

Pull request overview

This pull request refines the root Bun Dependabot configuration for safer, more predictable workspace updates.

Changes:

• Enables manifest range increases and raises the open PR limit.
• Isolates artifact-sensitive and pinned dependencies from grouped updates.
• Documents workspace and GitHub Actions coverage.

File summaries

File	Summary
.github/dependabot.yml	Refines Dependabot grouping, exclusions, range updates, and coverage documentation.

Review details

Suppressed comments (1)

.github/dependabot.yml:39

• This rationale incorrectly lists @adrkit/sdk as published. packages/sdk/package.json:22-23 explicitly describes it as a 0.0.0 design sketch, absent from the release package list, and not authorized for publication. Keeping /sdk here makes the stated consumer-range impact inaccurate; remove it or replace it with an actually published package.

    # `/cli`, `/evaluator`, `/mcp` and `/sdk` are published, so narrowing `^4` to

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite