⚙️ [Maintenance]: Dependabot updates retain default cooldown

.github/dependabot.yml

@@ -14,8 +14,6 @@ updates:
       interval: cron
       cronjob: "0 9 * * 1,3,5"
       timezone: Europe/Oslo
-    cooldown:
-      default-days: 3 # zizmor: ignore[dependabot-cooldown] Three days is the approved organizational cooldown.
 
   - package-ecosystem: pip # Build toolchain pinned in requirements.txt
     directory: /
@@ -26,5 +24,3 @@ updates:
       interval: cron
       cronjob: "0 9 * * 1,3,5"
       timezone: Europe/Oslo
-    cooldown:
-      default-days: 3 # zizmor: ignore[dependabot-cooldown] Three days is the approved organizational cooldown.

.github/linters/zizmor.yaml

@@ -0,0 +1,4 @@
+---
+rules:
+  dependabot-cooldown:
+    disable: true

src/docs/Capabilities/dependency-updates/design.md

@@ -60,15 +60,18 @@ proposal. It costs a few days of currency and buys the chance for an upstream pr
 to withdraw or supersede a bad release before every consumer has a pull request open
 against it. Currency is the goal; being first is not.
 
+The organization standard is Dependabot's implicit **three-day** cooldown for version updates. Repositories omit `cooldown` when they use that standard; an explicit mapping records a deliberate non-default duration.
+
 Security updates ignore both settings. An advisory means the pinned version is known
 bad now, and waiting for a schedule window or a cooldown would be waiting on purpose.
 
 ## The updater
 
 Dependabot opens **one PR per outdated or vulnerable dependency**, carrying the
 bump and the upstream release notes. SHA-pinned dependencies get the new commit
-SHA with the version as a trailing comment. Ecosystems, directories, schedule,
-cooldown, and the static labels all live in `.github/dependabot.yml`.
+SHA with the version as a trailing comment. Ecosystems, directories, schedule, and
+the static labels live in `.github/dependabot.yml`; a non-default cooldown belongs
+there too, while the standard three-day cooldown remains implicit.
 
 ```mermaid
 flowchart TD
@@ -160,7 +163,7 @@ and the same release path as any other update.
 | Native ecosystems and directories | `.github/dependabot.yml` | Generated from supported manifests |
 | Unsupported ecosystems | Central exception register | Centrally managed shared mechanism |
 | Schedule (`interval`, `day` and `time`, or `cronjob`) and `timezone` | `.github/dependabot.yml` | Organization configuration |
-| Cooldown | `.github/dependabot.yml` | Organization configuration |
+| Cooldown | Dependabot default (three days); explicit mapping only for a deliberate non-default duration | Organization configuration |
 | Static labels (`dependencies` + ecosystem) | `.github/dependabot.yml` | Generated |
 | `update:*` labels | Update metadata → labelling step | Derived per pull request |
 | Automatic-merge policy | Branch protection and merge automation | Organization configuration |

src/docs/Capabilities/dependency-updates/spec.md

@@ -63,7 +63,7 @@ Management](../release-management/spec.md).
 
 - **FR6 — Currency is checked on a schedule.** No human watches upstream releases.
 - **FR7 — The schedule is configuration.** Frequency and the timezone it is expressed in MUST be configurable per organization. There is no correct global cadence: a repository whose consumers deploy continuously wants updates sooner than one that ships quarterly, and a schedule expressed in a timezone nobody works in produces pull requests nobody triages.
-- **FR8 — Freshly published versions wait.** A version MUST NOT be proposed the moment it appears. A cooldown between publication and proposal lets an upstream project withdraw or supersede a bad release before every consumer has a pull request open against it.
+- **FR8 — Freshly published versions wait three days.** A version MUST NOT be proposed the moment it appears. The organization standard is Dependabot's default three-day cooldown, so a repository MUST omit an explicit `cooldown` mapping unless it deliberately adopts a non-default duration. The delay lets an upstream project withdraw or supersede a bad release before every consumer has a pull request open against it.
 - **FR9 — Security advisories bypass the schedule.** An advisory affecting a pin raises an update on disclosure, out of band, and MUST be prioritised over scheduled currency updates.
 
 ### Review and labelling

src/docs/Coding-Standards/GitHub-Actions.md

@@ -53,7 +53,7 @@ stale, unpatched code.
 - **Enable automated updates for the `github-actions` ecosystem** in
   `.github/dependabot.yml`. The updater opens a pull request that rewrites the
   pin to the new commit SHA and refreshes the trailing version comment.
-- **Apply a cooldown** before adopting a freshly published version.
+- **Apply Dependabot's default three-day cooldown** before adopting a freshly published version. Omit an explicit `cooldown` mapping unless the repository deliberately adopts a non-default duration.
 - **Label the update PR** with `dependencies` + `github-actions`, plus the
   dependency's own level (`update:major` / `update:minor` / `update:patch`).
   These update-level labels are deliberately **distinct from the release-bump