chore(deps): move the dependabot.yml change out to #2235

The npm-entry removal in `.github/dependabot.yml` is split out of this PR so
that every change to that one file lands in a single reviewable piece —
alongside the `github-actions` entry, which #2229 had declared out of scope but
which opens the same issue-less, board-cardless PR the decision exists to
remove.

Reverts `.github/dependabot.yml` to its `v2/main` state, leaving this PR with
the release-time `npm audit fix` and the monthly `npm outdated` sweep: the
replacement flow, not the switch-off.

Both new files' header comments claimed the switch-off had already happened,
which is false until #2235 lands. They now say #2235 does it, and that until
then Dependabot's npm PRs and this sweep overlap — duplicate signal rather than
conflicting action.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RWMJENjs1mExXE5XPJTEei
Signed-off-by: cliffhall <cliff@futurescale.com>

.github/dependabot.yml

@@ -1,26 +1,23 @@
 version: 2
 
-# npm version updates are OFF (#2229): a Dependabot version-update PR carries no
-# issue and no board card, which is the same "every PR references an issue"
-# carve-out the security-update flow had. Routine npm bumps are handled instead
-# by a monthly `npm outdated` sweep (`.github/workflows/dependency-refresh.yml`)
-# that files ONE tracking issue per run, boarded and milestoned like any other
-# work — so a maintainer picks the bump and opens a normal PR against `v2/main`.
-#
-# Security updates are unaffected by this file either way: they are enabled in
-# repo settings, not here. #2229 additionally proposes consuming them as
-# Dependabot ALERTS rather than PRs (tracked, not yet built) — until that lands,
-# security-update PRs still open against `main` and still need retargeting by
-# hand, same as before.
-#
-# github-actions version updates stay on Dependabot's own PR flow below — out of
-# scope for #2229, which was about npm packages specifically.
+# Version updates target `v2/main`, the develop branch where all v2 work lands,
+# not the default branch — `main` is release-only, holding the latest released
+# v2 and receiving milestone merges from `v2/main`. (The deprecated v1 line
+# lives on `v1/main` and takes security fixes only.)
 #
 # Two things to know about this file:
 #   1. Dependabot reads it from the DEFAULT branch (`main`). Changes here are
 #      inert until the next milestone merge carries them there.
-#   2. `target-branch` scopes VERSION updates only (npm updates are removed
-#      here, so this now only applies to the github-actions entry below).
+#   2. `target-branch` scopes VERSION updates. Dependabot SECURITY updates are
+#      enabled in repo settings, not here, and are raised against the default
+#      branch — they kept working while this file was missing entirely
+#      (see #1833, #1840). Per GitHub's Dependabot options reference, an entry
+#      whose `target-branch` names a non-default branch is NOT applied to
+#      security updates, so the schedule/labels/groups below shape version
+#      updates only. Re-confirm security PRs still appear after this lands.
+#
+# v2 is not an npm workspace: the root and each client under `clients/*` carry
+# their own package.json + lockfile, so each needs its own entry.
 
 updates:
   - package-ecosystem: "github-actions"
@@ -34,3 +31,63 @@ updates:
       github-actions:
         patterns:
           - "*"
+
+  - package-ecosystem: "npm"
+    directory: "/"
+    target-branch: "v2/main"
+    schedule:
+      interval: "monthly"
+    labels:
+      - "v2"
+    groups:
+      root-dependencies:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "npm"
+    directory: "/clients/web"
+    target-branch: "v2/main"
+    schedule:
+      interval: "monthly"
+    labels:
+      - "v2"
+    groups:
+      web-dependencies:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "npm"
+    directory: "/clients/cli"
+    target-branch: "v2/main"
+    schedule:
+      interval: "monthly"
+    labels:
+      - "v2"
+    groups:
+      cli-dependencies:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "npm"
+    directory: "/clients/tui"
+    target-branch: "v2/main"
+    schedule:
+      interval: "monthly"
+    labels:
+      - "v2"
+    groups:
+      tui-dependencies:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "npm"
+    directory: "/clients/launcher"
+    target-branch: "v2/main"
+    schedule:
+      interval: "monthly"
+    labels:
+      - "v2"
+    groups:
+      launcher-dependencies:
+        patterns:
+          - "*"

.github/workflows/dependency-refresh.yml

@@ -1,11 +1,15 @@
 # Monthly npm-outdated sweep (#2229), replacing Dependabot version-update PRs.
 #
-# Dependabot version updates are disabled in `.github/dependabot.yml` because a
-# version-update PR carries no issue and no board card. This workflow runs
-# `scripts/dependency-refresh.mjs` against `v2/main` once a month and files or
-# updates ONE tracking issue listing every outdated package across the root
-# install and each client — no PR is opened automatically. A maintainer reviews
-# the issue, picks what to bump, and opens a normal PR against `v2/main`.
+# A Dependabot version-update PR carries no issue and no board card, so npm
+# version updates are being switched off in `.github/dependabot.yml`. That file
+# is changed in #2235, not here — until it lands, Dependabot's npm PRs and this
+# sweep overlap, which is duplicate signal rather than conflicting action.
+#
+# This workflow runs `scripts/dependency-refresh.mjs` against `v2/main` once a
+# month and files or updates ONE tracking issue listing every outdated package
+# across the root install and each client — no PR is opened automatically. A
+# maintainer reviews the issue, picks what to bump, and opens a normal PR
+# against `v2/main`.
 #
 # `GITHUB_TOKEN` is sufficient: it only needs to read milestones (public) and
 # create/edit an issue (`issues: write`). Board placement is intentionally NOT

scripts/dependency-refresh.mjs

@@ -1,11 +1,12 @@
 #!/usr/bin/env node
 // Monthly npm-outdated sweep (#2229), replacing Dependabot version-update PRs.
 //
-// Dependabot's version updates were disabled in `.github/dependabot.yml`
-// because a version-update PR carries no issue and no board card — the same
+// A Dependabot version-update PR carries no issue and no board card — the same
 // carve-out from "every PR references an issue" that the security-update flow
 // had (that half is handled separately by the alert-driven pipeline, also
-// #2229). This script replaces the routine-bump half: once a month it runs
+// #2229). Turning npm version updates off in `.github/dependabot.yml` is #2235;
+// this script is the replacement it switches over to, and lands first, so the
+// two flows overlap until #2235 does. Once a month it runs
 // `npm outdated` across the root install and every client under `clients/*`
 // (each has its own package.json + lockfile — v2 is not a workspace), and
 // files or updates ONE tracking issue listing everything behind. A maintainer