infra: no Dependabot — action and npm pins drift silently

[GabrielBBaldez]

The library repo has .github/dependabot.yml; this one doesn't. The drift is already visible in the workflow — ci.yml here pins actions/checkout@v4 and actions/setup-node@v4, while the library is on actions/checkout@v7. Nobody decided that; the library's pins move because Dependabot opens the PR.

The npm side is small but not nothing:

"devDependencies": {
  "@types/node": "^20",
  "@types/vscode": "^1.85.0",
  "typescript": "^5.4.0"
}

@types/vscode is the one that matters. It has to stay in step with the engines.vscode floor, and when it drifts the failure is quiet — the compiler simply doesn't know about API added since, so a contributor reaching for a newer VS Code API gets a type error that looks like their mistake.

What to do

Add .github/dependabot.yml:

version: 2
updates:
  - package-ecosystem: npm
    directory: "/"
    schedule: { interval: weekly }
  - package-ecosystem: github-actions
    directory: "/"
    schedule: { interval: weekly }

Copy the grouping config from stacktale/stacktale/.github/dependabot.yml rather than inventing one — minor and patch updates land as a single PR instead of one per package, which matters more here than it looks, since every PR is a full CI run.

One judgement call to make and write down in the file as a comment: @types/vscode should not be bumped automatically. Raising it above engines.vscode lets code compile against API that the declared minimum VS Code doesn't have, and the extension then fails at runtime for users on the older version — with nothing in CI to catch it. Add an ignore entry for it so the pairing stays a deliberate decision:

    ignore:
      - dependency-name: "@types/vscode"

Verify

Insights → Dependency graph → Dependabot shows both ecosystems checked. Then confirm the ignore works: nothing opens a PR for @types/vscode even when a newer version exists.