fix: generalize the dependabot first-party @v1 exemption comment

.github/dependabot.yml

@@ -8,14 +8,14 @@
 # The `/` entry below scans `.github/workflows/`; the composite actions
 # (top-level and internal `.github/actions/*` alike) live in their own
 # folders, so each one with external `uses:` is listed explicitly. First-party
-# `Morrison-Lab/gha/*@v1` self-references and the `examples/` templates intentionally
-# track the `@v1` major tag and are not SHA-pinned, so they need no Dependabot
-# coverage.
+# `Morrison-Lab/gha/*` self-references and the `examples/` templates intentionally
+# track their capability's major tag (see the Versioning section of README.md)
+# rather than being SHA-pinned, so they need no Dependabot coverage.
 version: 2
 updates:
   - package-ecosystem: "github-actions"
     directories:
       - "/" # .github/workflows/
       - "/check-bibliography-dois"
       - "/check-links"
       - "/check-non-standard-chars"

changelog.d/generalize-dependabot-v1-comment.fixed.md

@@ -0,0 +1,9 @@
+- **Generalized `.github/dependabot.yml`'s first-party exemption comment** so it
+  no longer names a specific major tag (#310).
+  The header comment stated that first-party `Morrison-Lab/gha/*` self-references
+  and the `examples/` templates "track the `@v1` major tag", but capabilities now
+  pin various tags -- `@v2` for 20+ of them, `@v1` for the rest -- so the written
+  rationale for the Dependabot exemption read as stale.
+  It now names "their capability's major tag (see the Versioning section of
+  README.md)" instead, which cannot go stale again.
+  This is a comment-only change; the exemption policy itself is unchanged.