Add a Dependabot config for cargo and the workflows

.github/dependabot.yml

@@ -0,0 +1,57 @@
+# Dependabot for pecu, the CLI wallet.
+#
+# Ecosystems found in the repo: cargo (a single-package Cargo.toml with a
+# committed Cargo.lock) and github-actions (ci.yml, pages.yml and the
+# claude-* workflows). web/ is a static site built by a Python script with no
+# requirements.txt or pyproject.toml, so there is no pip manifest to watch.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+
+  - package-ecosystem: cargo
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      # Crate families that only work in lockstep, grouped so a bump cannot
+      # land half-applied. The reason this repo bothers: in peculium-wallet
+      # Dependabot bumped `vitest` and left `@vitest/coverage-v8` behind, and
+      # the resulting peer mismatch broke CI. Cargo has no peer dependencies to
+      # catch that for us, so the coupling is spelled out here.
+      #
+      # clap_complete is generated from clap's derive types and anstream/anstyle
+      # are the colour stack clap renders through: a major on one without the
+      # others does not compile.
+      clap:
+        patterns:
+          - clap
+          - "clap_*"
+          - anstream
+          - anstyle
+      # RustCrypto: shared trait crates, so the KDF, the AEAD and zeroize have
+      # to agree on the same trait major.
+      rustcrypto:
+        patterns:
+          - argon2
+          - chacha20poly1305
+          - zeroize
+          - getrandom
+      # rqrr decodes an image::GrayImage built by this crate, so an image
+      # major without the matching rqrr does not compile.
+      image:
+        patterns:
+          - image
+          - rqrr
+      dev-dependencies:
+        dependency-type: development
+        update-types: ["minor", "patch"]
+    ignore:
+      # verus-sdk is a git dependency pinned by revision on purpose: the CLI and
+      # chainvue-web-wallet pin the same commit so the two cannot build
+      # different transactions from the same inputs. Moving it is a deliberate,
+      # coordinated change, not a weekly bump.
+      - dependency-name: verus-sdk

.github/workflows/claude-pr-review.yml

@@ -60,7 +60,11 @@ jobs:
     # run on them -- and making it run, via pull_request_target, would hand an
     # outside contributor a workflow with write permissions on a wallet. A
     # maintainer reviews fork pull requests by hand. See docs/claude-automation.md.
-    if: github.event.pull_request.head.repo.full_name == github.repository
+    # Dependabot runs get no Actions secrets either, and the action rejects bot
+    # actors; skipped here, the required check still reports success.
+    if: >-
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.user.login != 'dependabot[bot]'
     runs-on: ubuntu-latest
     timeout-minutes: 25
     steps: