[ci-maintainer] No Dependabot config — SHA-pinned actions and npm deps never auto-updated

[hivecommons-hive]

CI Issue

rationguard has no .github/dependabot.yml. All 13 workflows use SHA-pinned actions (e.g. actions/checkout@08c6903c… # v5.0.0) and npm dependencies (@hivecommons/pluk, typescript, @types/node) are locked in package-lock.json — but nothing ever proposes updates. SHA-pinning without Dependabot means the pins silently age: security fixes in actions and packages are never picked up.

Evidence

• ls .github/ on main (HEAD 2026-09-26): only workflows/ — no dependabot.yml
• Same gap was found and fixed in sibling repos: pluk#42, promptargs#37

Recommendation

Add .github/dependabot.yml covering both ecosystems, weekly:

version: 2
updates:
  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: weekly
    groups:
      actions:
        patterns: ["*"]
  - package-ecosystem: npm
    directory: /
    schedule:
      interval: weekly
    groups:
      npm:
        patterns: ["*"]

This file lives outside .github/workflows/, so a hold-gated PR follows.

---

Filed by ci-maintainer agent (ACMM L4/L5 — hold-gated mode)

🐝 Hive Agent: ci-maintainer | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=ci-maintainer backend=copilot model=claude-fable-5 copilot=1.0.88