Remove redundant Dependabot cooldown configuration

[MariusStorhaug]

Context and request

Dependabot version updates retain their three-day default cooldown without explicitly declaring it, so the repository should rely on that default while keeping its independent update PR cadence unchanged.

Acceptance criteria

• .github/dependabot.yml contains no cooldown mappings or dependabot-cooldown suppression comments.
• Both github-actions and pip updates retain the 0 9 * * 1,3,5 schedule in Europe/Oslo and their existing labels.
• Dependabot continues to create separate update PRs rather than grouped update PRs.
• The dependency-update requirement, design, and GitHub Actions standard document Dependabot's three-day default cooldown and that security updates bypass it.
• Targeted strict Zizmor collection and YAML parsing succeed.

Constraints and non-goals

• Dependabot PR ⚙️ [Maintenance]: Dependency updates run independently #168 is historical and is not changed.
• This Task changes only the redundant cooldown configuration, its directly required Zizmor policy, and the governing standard; it does not alter update scheduling, labels, package ecosystems, directories, or grouping behavior.

---

Technical decisions

• Remove the two cooldown mappings and their inline suppression comments from .github/dependabot.yml.
• Disable only Zizmor's dependabot-cooldown audit in .github/linters/zizmor.yaml: Zizmor 1.25.2 requires an explicit mapping even when its threshold is lowered to Dependabot's documented three-day default, and Super-Linter reads its configuration from this path.
• Dependabot's documented default default-days value of three days provides the same behavior after removal; it gives ordinary version updates time for an upstream release to be withdrawn or superseded, while security updates bypass the delay.

Implementation plan

• Run targeted strict Zizmor collection and YAML parsing against the existing Dependabot configuration.
• Remove the redundant cooldown mappings and inline suppression comments from .github/dependabot.yml.
• Configure Super-Linter's Zizmor policy to disable only its explicit-cooldown audit, which cannot model Dependabot's implicit default.
• Document the three-day default and security-update exception in the governing dependency-update and GitHub Actions standards.
• Re-run targeted strict Zizmor collection and YAML parsing, then inspect the focused diff to confirm schedules, labels, and separate-update behavior remain intact.
• Run the documentation validations and repository Pester suite and record the result in the delivery pull request.

[MariusStorhaug]

Marked the implementation plan complete after the focused configuration change. YAML parsing, documentation-index verification, and all 87 Pester tests pass. Strict Zizmor collection completes and reports two expected medium cooldown warnings because its audit requires an explicit mapping and does not model Dependabot's documented three-day default; no inline suppression remains.

[MariusStorhaug]

Corrected the completed plan to record the directly required repository-level Zizmor policy. Zizmor 1.25.2 treats an omitted cooldown mapping as a finding even when configured for three days, so .github/zizmor.yml disables only that audit; targeted and full offline Zizmor scans now pass with Dependabot's documented default intact.

[MariusStorhaug]

Corrected the policy path after confirming Super-Linter invokes Zizmor with .github/linters/zizmor.yaml, rather than Zizmor's standard discovery path. The scoped audit disable now loads in the same command CI runs; strict targeted and repository-wide scans pass.

[MariusStorhaug]

Extended the completed Task to document the confirmed organization standard: Dependabot's implicit three-day cooldown applies to ordinary version updates, giving a newly published upstream release time to be withdrawn or superseded; security updates bypass that delay. The dependency-update requirement and design and the GitHub Actions standard now carry this policy.