chore(deps): remove dependabot.yml, fold action bumps into the monthly sweep

.github/workflows/dependency-refresh.yml

@@ -1,21 +1,27 @@
-# Monthly npm-outdated sweep (#2229), replacing Dependabot version-update PRs.
+# Monthly dependency sweep (#2229), replacing Dependabot's VERSION-UPDATE PRs.
 #
-# A Dependabot version-update PR carries no issue and no board card, so npm
-# version updates are being switched off in `.github/dependabot.yml`. That file
-# is changed in #2235, not here — until it lands, Dependabot's npm PRs and this
-# sweep overlap, which is duplicate signal rather than conflicting action.
+# A Dependabot version-update PR carries no issue and no board card, so
+# `.github/dependabot.yml` was removed outright in #2235 — npm and
+# github-actions alike. This workflow is what replaced those PRs (security
+# updates are a separate mechanism and stay on; see below): it runs
+# `scripts/dependency-refresh.mjs` against `v2/main` once a month and files or
+# updates ONE tracking issue listing every outdated npm package across the root
+# install and each client, plus any workflow `uses:` ref behind its action's
+# highest released version. No PR is opened automatically. A maintainer
+# reviews the
+# issue, picks what to bump, and opens a normal PR against `v2/main`.
 #
-# This workflow runs `scripts/dependency-refresh.mjs` against `v2/main` once a
-# month and files or updates ONE tracking issue listing every outdated package
-# across the root install and each client — no PR is opened automatically. A
-# maintainer reviews the issue, picks what to bump, and opens a normal PR
-# against `v2/main`.
+# Dependabot SECURITY updates are unaffected: they are enabled in repo
+# settings, not in a config file, and kept working while `dependabot.yml` was
+# missing entirely (see #1833, #1840). They are raised against the default
+# branch and still need retargeting by hand.
 #
-# `GITHUB_TOKEN` is sufficient: it only needs to read milestones (public) and
-# create/edit an issue (`issues: write`). Board placement is intentionally NOT
-# attempted here — that needs an org-project PAT this token cannot have — so a
-# filed-but-unboarded issue is picked up by the next `/issue-triage` sweep,
-# same as any other maintainer-filed issue.
+# `GITHUB_TOKEN` is sufficient: it only needs to read milestones and the public
+# release feeds of the actions we use, and to create/edit an issue
+# (`issues: write`). Board placement is intentionally NOT attempted here — that
+# needs an org-project PAT this token cannot have — so a filed-but-unboarded
+# issue is picked up by the next `/issue-triage` sweep, same as any other
+# maintainer-filed issue.
 name: Dependency Refresh
 
 on:
@@ -28,7 +34,7 @@ permissions:
   issues: write
 
 jobs:
-  npm-outdated:
+  dependency-sweep:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout v2/main
@@ -45,7 +51,7 @@ jobs:
       - name: Install dependencies (root + all clients)
         run: npm install
 
-      - name: Run the npm-outdated sweep
+      - name: Run the dependency sweep (npm packages + workflow actions)
         run: node scripts/dependency-refresh.mjs
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}