ci: group the go modules that ship together

[otavio]

group-by: dependency-name gives each dependency its own pull request across the
six Go modules, which is right for a dependency that moves on its own — and it is
why this config is not simply the one cloud uses.

It is wrong for a project shipping several modules. Those release together and pin
each other, so one pull request per module carries the same edits in each and only
the first can land. caddy was already carved out for exactly this reason; this
names the other three.

group	modules	grouped for
caddy (existing)	caddyserver/*, caddy-dns/*	all updates
testcontainers	testcontainers-go + compose, postgres, redis	all updates
bun	uptrace/bun, uptrace/bun/dialect/pgdialect	all updates
golang-x	golang.org/x/crypto, exp, net, sys, time	version updates only

The catch-all excludes each by hand, because a dependency matching more than one
group is not placed in the first match — the same caveat already noted on the npm
entry.

golang-x keeps applies-to: version-updates where the others drop it: those
modules are not coupled, they only tend to move together, so an x/crypto or
x/net security fix should still arrive on its own rather than waiting behind an
x/exp bump.

Verification

Resolved the patterns against the 56 direct requirements across /, /agent,
/gateway, /openapi, /server and /tests:

• the four groups match exactly the modules in the table (5 + 4 + 2 + 5),
• no dependency matches more than one group, and
• the remaining 38 fall to the catch-all and keep arriving one pull request each.

No change to github-actions, docker or npm.

[github-actions]

Claude finished @otavio's task in 1m 8s —— View job

---

Code Review Complete

Reviewed 1 file (.github/dependabot.yml) across config correctness, grouping semantics, and pattern coverage — no new issues found. The code looks good as-is.

A few things I verified in the diff:

• Pattern coverage is complete — each group pairs the bare module path with a /* variant (testcontainers-go + testcontainers-go/*, uptrace/bun + uptrace/bun/*) so both the root module and its submodules match; golang.org/x/* covers crypto/exp/net/sys/time.
• Catch-all exclusions mirror the group patterns exactly — all four groups are excluded from go-modules, keeping every coupled dependency in its own group and matching the existing caddy/npm convention already in this file.
• applies-to semantics are right — golang-x stays version-updates, so an x/crypto/x/net security fix matches neither golang-x nor the version-only catch-all and lands as its own PR, while testcontainers/bun omit applies-to and group all update types. This matches the stated intent.