v2.3.1 — dependabot.yml filled in

.github/dependabot.yml was still the GitHub starter template with an empty package-ecosystem, which Dependabot rejects — so it was watching nothing.

Filled in with github-actions, the only ecosystem that applies here: the workflow pins actions/checkout and actions/setup-python, and the repository has no package manifests. Bumps are grouped into a single pull request rather than one per action.

The file also records why pip is deliberately absent — ruff is installed inline in a run: step, and Dependabot does not parse those; it needs a manifest. The block to paste in, should ruff ever be pinned in one, is in the comment.