Backport sync-agent-instructions.yml (#518) and dependabot.yml to main ahead of default-branch switch

[tvna]

Context

Root-cause analysis (delegated to a subagent per owner request) of a release-process bug found that this repo's actual GitHub default branch is develop, and GitHub Actions resolves schedule triggers (and default-ref workflow_dispatch runs) using the workflow YAML on the default branch, not main. The release-fix chain (#521/#523/#525/#526, landed via PR #527) was applied only to main, so develop's stale release.yml schedule has been running weekly and silently no-op'ing (green "success", nothing published) since 2026-07-06.

Owner decision: switch GitHub's default branch from develop to main. Confirmed via Claude Code's own docs (code.claude.com/docs/en/web-quickstart) that both the web and mobile apps expose a per-session branch selector independent of the repo's default branch, so this doesn't block starting sessions from develop going forward — it only removes the automatic pre-fill (one manual branch pick per new session).

Before flipping the default branch, two other default-branch-coupled files need to be at parity on main, or the flip regresses them:

Scope

1. .github/workflows/sync-agent-instructions.yml — this finishes CI: target sync-agent-instructions.yml PRs at develop instead of main #518, which changed the sync-claude-md/sync-apm-skills jobs to target develop (explicit ref: develop checkout, base: develop) and added a third sync-rulesets job, but that change only ever landed on develop's copy of the file. main's copy is still the pre-CI: target sync-agent-instructions.yml PRs at develop instead of main #518 version (2 jobs, no explicit ref, base: main). Bring main's copy to parity with develop's current content.
2. .github/dependabot.yml — main's copy predates the npm-to-bun migration (Migrate JavaScript package management from npm to bun #353): it still lists a package-ecosystem: npm entry (invalid now that package-lock.json no longer exists) and uses pip instead of uv for the Python ecosystem. GitHub reads this file from the default branch, so flipping to main would silently regress dependabot to the stale config. Bring main's copy to parity with develop's current content.

release.yml needs no change — main's copy is already the fixed one (daily cadence, --no-ci, develop-derived commit prep) and will start running correctly the moment main becomes the default branch.

Non-goals

• Resolving Release workflow: push to protected main rejected (GH013) - document ruleset bypass actor setup #525 (RELEASE_TOKEN ruleset-bypass-actor setup) — separate, owner-only GitHub Identity/settings action, independent of the default-branch switch.
• Backporting the ruleset-management workflow (apply-rulesets.yml, scripts/rulesets_apply.py, .github/rulesets/) to main — it's push/workflow_dispatch-triggered, not schedule-triggered, so it isn't default-branch-coupled and is fine staying on develop only.
• Changing the actual GitHub default-branch setting — no API/MCP tool for this is available; the owner will do this manually after this PR merges.

Refs #518.