fix: generalize the dependabot first-party @v1 exemption comment

[d-morrison]

Closes #310

The bug

.github/dependabot.yml's header comment stated that first-party
Morrison-Lab/gha/*@v1 self-references and the examples/ templates
"track the @v1 major tag". That blanket @v1 is stale: capabilities now pin
various major tags -- @v2 for 20+ of them (preview, claude-code-review,
update-snapshots, ...), @v1 for the rest. The comment is the written
rationale for why first-party refs are exempt from Dependabot, so a reader
checking whether the exemption still applies got a tag number that no longer
matches what the repo pins.

The fix

Name the tag generically -- "their capability's major tag (see the Versioning
section of README.md)" -- so the rationale cannot go stale again, and drop the
specific @v1 from the Morrison-Lab/gha/* glob. The policy itself (first-party
refs track the major tag rather than being SHA-pinned) is unchanged and still
correct.

Scope note

@v1 is not universally stale -- it is still the correct pin for many
capabilities -- so this is deliberately not a blanket @v1->@v2 sweep; only
the one comment that made a blanket @v1 claim is touched.

A grep for the same rationale restated elsewhere found one hit:
CHANGELOG.md:328-329 (d-morrison/gha/*@v1 ... "still track the @v1 major
tag", #48). That is a released historical changelog entry and is left as-is,
per the org-move fragment's own convention that historical CHANGELOG.md /
changelog.d/ entries keep the name and state they had when written -- it
accurately records what was true at #48's time.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[d-morrison]

ARD summary

Review verdict was Ready for merge with one optional (non-blocking) note. Addressed in 17aeb0d:

• Missing changelog fragment: added changelog.d/generalize-dependabot-v1-comment.fixed.md, matching the repo's consistent precedent for stale-@v1-doc fixes (pin-check-news-v1-to-v2, fix-remaining-stale-v1-examples, retarget-doc-urls-after-org-move).

The reviewer independently re-ran the whole-repo grep and confirmed the sweep is complete: the only other hit (CHANGELOG.md:328) is correctly left as a released historical entry, and README.md:482 already carries the correct (currently @v1, except ...) exception clause. Thread resolved.

[github-actions]

Claude finished review — View run

---

The only change since the last review round is a new commit (17aeb0d) adding changelog.d/generalize-dependabot-v1-comment.fixed.md. I verified it:

• Filename/format: <slug>.<category>.md with category fixed — correct per changelog.d/README.md, and matches the exact precedent pattern (pin-check-news-v1-to-v2.fixed.md, fix-remaining-stale-v1-examples.fixed.md) cited in the prior review's nit.
• Content accuracy: The bullet's claims ("capabilities now pin various tags — @v2 for 20+ of them, @v1 for the rest", "comment-only change; the exemption policy itself is unchanged") match what the prior review round already independently verified against README.md's Versioning section and the actual diff.
• Style: No AI-tell vocabulary, bold-lead bullet matches the format shown in the fragment README's own example and matches the dense documentary voice of the repo's existing fragments.
• .github/dependabot.yml itself is byte-for-byte unchanged from the version already reviewed and confirmed correct in the prior round.

This fully resolves the only outstanding item (the optional changelog-fragment nit) from the prior review, which found no blocking issues and reached a Ready for merge verdict. No new findings.

Verdict

Ready for merge

[github-actions]

💰 Cost: $0.7923 (review) — run