Cut Actions runs: monthly Dependabot, lint on pull requests only #75

Why

The org is on the GitHub Free plan: 2,000 Actions minutes a month, shared by the private repos. October is at 962 minutes by the 9th. Nearly every run is one job billed at a one-minute floor, so the lever is fewer runs. This repo is public.

The shared half is already done and needs no change here: studiobimo/.github v1.11.1 (studiobimo/.github#61) cancels a pull request run when a newer push supersedes it, and skips pr-checks for Dependabot and for edits that touch neither the title nor the base. This repo calls ci-* at @v1, so it inherits that already.

What a consumer has to change itself:

1. Dependabot: monthly, capped (template block via sync, own blocks by hand)

In .github/dependabot.yml, for every ecosystem block:

    schedule:
      interval: monthly
    open-pull-requests-limit: 3

Keep cooldown.default-days: 7 (zizmor's dependabot-cooldown audit). Security updates ignore schedule, so nothing urgent waits.

Four blocks here: gradle, github-actions, pre-commit and uv. The last two are the old template's ecosystems; check whether they are still in use before keeping them. Public repos do not draw on the 2,000-minute quota, so this is lower urgency than bimo-model and zero-trust.

Status: project-template v0.3.2 is released and carries this block, so make -C .devtools sync applies it. The template-managed block comes from the sync; the repo's own blocks and lint.yml are hand edits. Both are in #77.

2. Lint only on pull requests

.github/workflows/lint.yml runs on push to main and on merge_group. Every change reaches main through a pull request that already ran the same hooks, and no ruleset enables a merge queue, so those runs repeat work. Reduce on: to:

on:
  pull_request:

Reference

• studiobimo/bimo-mod#64: the same change applied, with the live test (title edit re-runs the checks, body edit is skipped and reported as skipped).
• chore(deps): update dependabot monthly and cap open pull requests .github#60, fix(workflows): skip runs that cannot change a result .github#61, chore(deps): update github actions monthly and cap open pull requests project-template#14.

Done when

• Every ecosystem block in .github/dependabot.yml is monthly with open-pull-requests-limit: 3
• lint.yml triggers on pull_request only
• zizmor is clean on both files