fix(deps): consolidate dependabot uv ecosystem to single workspace root

[jsonmp-k8]

Summary

• replace the per-member directories: list under package-ecosystem: uv with a single /python entry so Dependabot uses the root [tool.uv.workspace] to discover members and refreshes python/uv.lock in the same PR
• group OpenTelemetry and Google AI Python dependencies so lockstep families land in a single PR
• add applies-to: version-updates to the Python groups so security updates remain ungrouped
• ignore semver-major /ui npm bumps so known-breaking major frontend upgrades stop opening standalone PRs

Why

Dependabot was opening separate PRs for each workspace member's pyproject.toml without refreshing the root python/uv.lock. Those PRs then failed CI when Docker runs uv sync --locked.

In a uv workspace the lockfile lives only at the workspace root; members have only a pyproject.toml. Dependabot's native uv ecosystem already discovers workspace members through the root [tool.uv.workspace] section, so a single directory: /python entry covers every member and updates the root lockfile alongside any member manifest in the same PR — no separate workflow or write-back step needed.

This replaces the earlier approach in this PR which used a pull_request_target workflow to run uv lock and push back to Dependabot's branch. @EItanya flagged that handoff as undesirable; this approach removes it entirely (and removes the new workflow file) while keeping the orthogonal grouping and ignore improvements.

Verification

• ruby -e 'require "yaml"; YAML.load_file(".github/dependabot.yml")' (parses cleanly)
• Once merged, the next Dependabot run on a Monday should produce at most one Python PR per group with both the changed pyproject.toml and python/uv.lock updated together.

[Copilot]

Pull request overview

Stabilizes Dependabot-driven Python (uv) dependency updates by ensuring the root workspace lockfile stays in sync with workspace manifest changes, reducing CI failures when uv sync --locked runs in downstream builds.

Changes:

• Add a guarded pull_request_target workflow to regenerate and commit python/uv.lock for eligible Dependabot PRs.
• Update Dependabot config to group related root-workspace uv dependency families (OpenTelemetry and Google AI) into single PRs.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
.github/workflows/refresh-python-workspace-lock.yml	New workflow that validates PR file shape, runs uv lock, and pushes refreshed python/uv.lock back to Dependabot branches.
.github/dependabot.yml	Adds uv grouping rules for OpenTelemetry and Google AI dependencies; clarifies grouping behavior for minor/patch updates.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[jsonmp-k8]

@EItanya Some improvements to dependabot to avoid stale PR's

[EItanya]

I don't particularly love the github actions handoff here. This must be a common problem, how are others doing this?

[jsonmp-k8]

@EItanya — reworked per your feedback. Dropped the GitHub Actions handoff entirely.

The root cause was the directories: list naming every uv workspace member. In a uv workspace the lockfile lives only at the root, so Dependabot opening PRs against members couldn't refresh python/uv.lock. Collapsing to a single directory: /python lets Dependabot's native uv ecosystem discover members through [tool.uv.workspace] and update the root lock in the same PR — which is how the native uv support is designed to work for workspaces.

PR is now a one-file diff (.github/dependabot.yml); the refresh-python-workspace-lock.yml workflow is gone.