chore(deps): add 30-day Dependabot cooldown and napi group

[dean0x]

Why

24 Dependabot PRs were queued with an average age of ~30 days — all behind/dirty
relative to current main. Without a cooldown, Dependabot's built-in 3-day default
means every new release is proposed almost immediately, well before any ecosystem
soak time. This change codifies the project's existing informal 30-day soak policy
as a first-class config value.

The napi group addresses a concrete regression: PR #282 bumped napi-derive alone
and produced 16 compile errors because napi, napi-derive, and napi-build are
ABI-coupled and must move together. A grouped PR prevents that split from recurring.

What

Three cooldown.default-days: 30 blocks (one per ecosystem) and a cargo groups.napi
entry. Key facts, verified 2026-09-05 against the live GitHub Docs Dependabot options reference:

• cooldown.default-days is supported by the cargo, npm, and github-actions ecosystems.
• semver-major-days / semver-minor-days / semver-patch-days sub-keys are NOT supported
  for github-actions, so only default-days is used everywhere for uniformity.
• Without a cooldown key Dependabot applies a 3-day built-in default.
• Cooldown applies to version updates only — security updates always arrive immediately.
• Groups are scoped per package-ecosystem entry and cannot span ecosystems; @napi-rs/cli
  (npm side) therefore stays a standalone PR.

Not included

No pip ecosystem is added. The only Python-side dependency, maturin, is declared in crates/mds-python/pyproject.toml under [build-system].requires, which Dependabot's pip ecosystem does not track, and the [project] table declares no dependencies, so a pip entry would produce no PRs. The maturin version used by CI is pinned in the workflow files.

Verification

1. YAML parses — confirmed with node -e "const y=require('js-yaml'); …" (js-yaml
   is a hoisted workspace devDependency). Result: 3 updates entries, each with
   cooldown.default-days == 30; only the cargo entry has
   groups.napi.patterns == ["napi","napi-derive","napi-build"].
2. Source hygiene gate — node scripts/verify-no-control-bytes.mjs exited 0:
   "Scanned 552 file(s), 5924221 byte(s)".
3. One file changed — git diff --stat shows only .github/dependabot.yml,
   16 insertions.
4. No local schema validator — there is no local Dependabot YAML schema validator
   in this repo. The post-merge check is the repository's
   Insights → Dependency graph → Dependabot tab: a config error shows there as a
   red banner within minutes of merge.

Expected effect

After the next weekly Dependabot run:

• Version updates younger than 30 days are held until they age out.
• The three napi-ecosystem crates arrive in a single grouped PR instead of three
  individual ones.
• Security updates are unaffected and still arrive immediately.

The existing backlog of stale Dependabot PRs is being flushed manually in a separate sweep.

Part of v0.4.3 housekeeping (step A1 of the v0.4.3 action plan).