chore: add a dependency watcher (#12)

23 of 30 repos in the fleet had none. The symptom looks like neglect and
is not: aoz-housing had 100 commits in August, features landing daily, and
was still on Next 14 / React 18 / Tailwind 3 — because nothing ever OPENED
the upgrade PR. Version drift here is the absence of a mechanism.

npm directory: /. Minor and patch grouped so the sweep spends one
cycle on them; majors stay separate because they deserve reading.


Claude-Session: https://claude.ai/code/session_01UvjGNAS9CMfEGNW26tUR4P

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: catomean

.github/dependabot.yml

@@ -0,0 +1,26 @@
+# Dependency updates, weekly.
+#
+# Added 2026-08-29 after a fleet audit found 23 of 30 repos had no watcher at
+# all. The symptom looked like neglect and was not: aoz-housing had 100 commits
+# that month and was still on Next 14, because nothing ever opened the PR.
+# Drift here is the absence of a mechanism, not the absence of attention.
+#
+# Minor and patch are grouped into one PR so the auto-merge sweep spends one
+# cycle on them instead of five; majors stay separate because they deserve to
+# be read.
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      minor-and-patch:
+        update-types: [minor, patch]
+
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 3