chore(deps): remove dependabot.yml, fold action bumps into the sweep

Closes #2235.

Switches the old dependency flow off now that #2232 landed the
replacement. Removes the five npm ecosystem entries (root plus each
client under clients/*) and, resolving the question #2229 left open, the
github-actions entry as well — so .github/dependabot.yml goes away
outright rather than being emptied, which its schema does not allow.

The github-actions entry had exactly the property #2229 exists to
remove: it opened a grouped monthly PR carrying no `Closes #N` and no
board card, the one standing exception to "every PR references an
issue". Deleting it unreplaced would have left 9 actions unwatched, and
`npm outdated` says nothing about actions, so the monthly sweep now also
checks every `uses:` ref under .github/workflows and renders the stale
ones as one more section of the same tracking issue.

Ranking comes from the release LIST, not `releases/latest`. That
endpoint returns the release GitHub designates most recent, not the
greatest version, so an action publishing a maintenance release for an
older major (a v6.9.1 cut after v8.0.0) would make a workflow pinned to
v7 compare against v6 and read as current — silently missing a whole
major upgrade, the one thing this check exists to catch.

Staleness is compared only to the precision the ref specifies. `v7` is a
moving major tag that GitHub repoints at every v7.x release, so `v7`
against a highest of `v7.0.1` is current and only `v8` makes it stale;
an exactly-pinned `v7.0.0` is behind `v7.0.1`; a SHA pin is deliberately
immovable and is never reported.

A release lookup suppresses only a 404 — the legitimate "this action has
never cut a release" answer — and throws on anything else. Treating a
rate limit or an expired token as "no release" is indistinguishable from
"not stale", and since every action here already sits on its latest
major, the resulting empty section is byte-identical to a healthy run.

`buildClearedBody` now speaks for both halves: once actions are in scope,
its npm-only wording would assert a clean bill of health the sweep never
checked.

Dependabot security updates are unaffected — they are configured in repo
settings, not in this file, and kept working while it was missing
entirely (#1833, #1840). That note moves into the workflow header rather
than dying with the file; #2233 is where they are turned off
deliberately. The script header, the workflow header and the generated
issue body all say version-update PRs rather than claiming Dependabot is
replaced wholesale.

Also renames the workflow's npm-outdated job to dependency-sweep now
that the sweep is no longer npm-only.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NGtzPg3UxMLszysQXXfqax
Signed-off-by: cliffhall <cliff@futurescale.com>

.github/dependabot.yml

@@ -1,93 +0,0 @@
-version: 2
-
-# Version updates target `v2/main`, the develop branch where all v2 work lands,
-# not the default branch — `main` is release-only, holding the latest released
-# v2 and receiving milestone merges from `v2/main`. (The deprecated v1 line
-# lives on `v1/main` and takes security fixes only.)
-#
-# Two things to know about this file:
-#   1. Dependabot reads it from the DEFAULT branch (`main`). Changes here are
-#      inert until the next milestone merge carries them there.
-#   2. `target-branch` scopes VERSION updates. Dependabot SECURITY updates are
-#      enabled in repo settings, not here, and are raised against the default
-#      branch — they kept working while this file was missing entirely
-#      (see #1833, #1840). Per GitHub's Dependabot options reference, an entry
-#      whose `target-branch` names a non-default branch is NOT applied to
-#      security updates, so the schedule/labels/groups below shape version
-#      updates only. Re-confirm security PRs still appear after this lands.
-#
-# v2 is not an npm workspace: the root and each client under `clients/*` carry
-# their own package.json + lockfile, so each needs its own entry.
-
-updates:
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    target-branch: "v2/main"
-    schedule:
-      interval: "monthly"
-    labels:
-      - "v2"
-    groups:
-      github-actions:
-        patterns:
-          - "*"
-
-  - package-ecosystem: "npm"
-    directory: "/"
-    target-branch: "v2/main"
-    schedule:
-      interval: "monthly"
-    labels:
-      - "v2"
-    groups:
-      root-dependencies:
-        patterns:
-          - "*"
-
-  - package-ecosystem: "npm"
-    directory: "/clients/web"
-    target-branch: "v2/main"
-    schedule:
-      interval: "monthly"
-    labels:
-      - "v2"
-    groups:
-      web-dependencies:
-        patterns:
-          - "*"
-
-  - package-ecosystem: "npm"
-    directory: "/clients/cli"
-    target-branch: "v2/main"
-    schedule:
-      interval: "monthly"
-    labels:
-      - "v2"
-    groups:
-      cli-dependencies:
-        patterns:
-          - "*"
-
-  - package-ecosystem: "npm"
-    directory: "/clients/tui"
-    target-branch: "v2/main"
-    schedule:
-      interval: "monthly"
-    labels:
-      - "v2"
-    groups:
-      tui-dependencies:
-        patterns:
-          - "*"
-
-  - package-ecosystem: "npm"
-    directory: "/clients/launcher"
-    target-branch: "v2/main"
-    schedule:
-      interval: "monthly"
-    labels:
-      - "v2"
-    groups:
-      launcher-dependencies:
-        patterns:
-          - "*"

.github/workflows/dependency-refresh.yml

@@ -1,21 +1,27 @@
-# Monthly npm-outdated sweep (#2229), replacing Dependabot version-update PRs.
+# Monthly dependency sweep (#2229), replacing Dependabot's VERSION-UPDATE PRs.
 #
-# A Dependabot version-update PR carries no issue and no board card, so npm
-# version updates are being switched off in `.github/dependabot.yml`. That file
-# is changed in #2235, not here — until it lands, Dependabot's npm PRs and this
-# sweep overlap, which is duplicate signal rather than conflicting action.
+# A Dependabot version-update PR carries no issue and no board card, so
+# `.github/dependabot.yml` was removed outright in #2235 — npm and
+# github-actions alike. This workflow is what replaced those PRs (security
+# updates are a separate mechanism and stay on; see below): it runs
+# `scripts/dependency-refresh.mjs` against `v2/main` once a month and files or
+# updates ONE tracking issue listing every outdated npm package across the root
+# install and each client, plus any workflow `uses:` ref behind its action's
+# highest released version. No PR is opened automatically. A maintainer
+# reviews the
+# issue, picks what to bump, and opens a normal PR against `v2/main`.
 #
-# This workflow runs `scripts/dependency-refresh.mjs` against `v2/main` once a
-# month and files or updates ONE tracking issue listing every outdated package
-# across the root install and each client — no PR is opened automatically. A
-# maintainer reviews the issue, picks what to bump, and opens a normal PR
-# against `v2/main`.
+# Dependabot SECURITY updates are unaffected: they are enabled in repo
+# settings, not in a config file, and kept working while `dependabot.yml` was
+# missing entirely (see #1833, #1840). They are raised against the default
+# branch and still need retargeting by hand.
 #
-# `GITHUB_TOKEN` is sufficient: it only needs to read milestones (public) and
-# create/edit an issue (`issues: write`). Board placement is intentionally NOT
-# attempted here — that needs an org-project PAT this token cannot have — so a
-# filed-but-unboarded issue is picked up by the next `/issue-triage` sweep,
-# same as any other maintainer-filed issue.
+# `GITHUB_TOKEN` is sufficient: it only needs to read milestones and the public
+# release feeds of the actions we use, and to create/edit an issue
+# (`issues: write`). Board placement is intentionally NOT attempted here — that
+# needs an org-project PAT this token cannot have — so a filed-but-unboarded
+# issue is picked up by the next `/issue-triage` sweep, same as any other
+# maintainer-filed issue.
 name: Dependency Refresh
 
 on:
@@ -28,7 +34,7 @@ permissions:
   issues: write
 
 jobs:
-  npm-outdated:
+  dependency-sweep:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout v2/main
@@ -45,7 +51,7 @@ jobs:
       - name: Install dependencies (root + all clients)
         run: npm install
 
-      - name: Run the npm-outdated sweep
+      - name: Run the dependency sweep (npm packages + workflow actions)
         run: node scripts/dependency-refresh.mjs
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}