chore: add Dependabot configuration for automated dependency updates

[chernojagne]

What

Adds .github/dependabot.yml to enable automated dependency updates via Dependabot.

Why

This is a pnpm monorepo with 12+ packages (ark/attest, ark/type, ark/schema, ark/util, ark/repo, ark/fast-check, ark/regex, ark/json-schema, ark/extension, ark/themes, ark/docs, ark/fs, plus root) and no automated dependency update tooling — no Dependabot config, no Renovate config.

Dependabot will keep npm dependencies and GitHub Actions current. The config uses a weekly schedule with grouped updates to keep PRs manageable (one PR per ecosystem per week rather than one per dependency).

---

This change was generated by Autar and reviewed by a human before submission.

[pullfrog]

Important

This is a pnpm workspace with a single root pnpm-lock.yaml, so the 13 npm update entries (12 per-subdirectory + the root one) all operate on the same lockfile and are redundant with each other. They'll raise duplicate, mutually-conflicting grouped PRs that each rewrite the one root lockfile — the opposite of the "one PR per week" goal stated in the description. Collapse them into a single root directory: "/" npm entry.

Reviewed changes

• Add .github/dependabot.yml enabling Dependabot version updates for npm and github-actions, weekly, with an all-dependencies group — declared once per workspace package (12 entries) plus one root entry.

The core concern is anchored inline on the first npm entry; it applies unchanged to all 13 npm entries including the root / one. github-actions doesn't share the issue (Actions reads /.github/workflows directly), though the file still carries one entry (now eleven in the original — actually one Actions entry) which is fine as-is.

Technical details

# Per-subdirectory npm entries are redundant in a pnpm workspace

## Affected sites
- .github/dependabot.yml:3-4 (npm /ark/attest) through :118, and the root entry at :111-119 — all 13 `package-ecosystem: npm` entries converge on the single root `pnpm-lock.yaml`.

## Required outcome
- Configure Dependabot once for the whole npm workspace instead of once per package subdirectory.

## Suggested approach (optional)
Replace the 12 `directory: /ark/*` npm entries and the root `directory: /` npm entry with one:

```yaml
- package-ecosystem: npm
  directory: "/"
  schedule:
    interval: weekly
  groups:
    all-dependencies:
      patterns:
        - "*"
```

This also eliminates the 13x duplication of the identical `all-dependencies` block (any future schedule/grouping change currently has to be edited in thirteen places).

## Open questions for the human (optional)
- If any dependency is intentionally pinned/different per package, confirm whether the group-level settings need per-package granularity; if not (the norm for a workspace), the single root entry is correct.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using DeepSeek Flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

This repo is a pnpm workspace (pnpm-workspace.yaml declares packages: ["ark/*"]) with a single root pnpm-lock.yaml and no per-package lockfiles. Every one of these 12 per-subdirectory npm entries — plus the root directory: / npm entry at :111-119 — resolves to and rewrites that same root lockfile, so they are all redundant and will raise duplicate, mutually-conflicting grouped PRs (dependabot-core has open bugs on this shared-lockfile npm-monorepo behavior, e.g. #6346). Collapse all 13 npm entries into a single root directory: "/" npm entry, which governs the entire workspace. This also removes the 13x repetition of the identical all-dependencies block, so future schedule/grouping changes are edited once instead of thirteen times.

[chernojagne]

Good catch — you're right that all the per-subdirectory npm entries resolve to the same root pnpm-lock.yaml, which causes the conflicting grouped-PR issue you described. Collapsed all 13 npm entries into a single directory: "/" entry in 66f6675.

[chernojagne]

Closing this — we're revising how we approach these contributions and would rather withdraw it than leave it open unattended. Apologies for the noise, and thanks.