chore(dependabot): follow dependency updates upstream

[Rook-CodeVolt]

Summary

• disable scheduled Dependabot version-update PRs in this contribution-only fork
• retain repository-level Dependabot alerts and security updates
• document the fork/upstream dependency policy beside the configuration
• map the fork maintainer's commit email to the canonical GitHub login so contributor attribution can pass

Rationale

This fork exists to contribute changes upstream rather than maintain a separate product. Routine dependency versions should follow NousResearch/hermes-agent instead of creating fork-only lockfile drift.

The zero-job CI failures were diagnosed as GitHub Actions orchestration errors rather than a defect in ci.yaml. The failed run pages report “An unexpected error has occurred” with GitHub Support request IDs, while identical workflow content successfully created jobs between failures. A temporary workflow-path replacement reproduced the same platform error and has been fully reverted; the PR now retains the inherited ci.yaml identity and has no effective CI workflow diff.

Verification

• .github/dependabot.yml parses as valid YAML through repository file validation
• configuration contains one github-actions update entry with open-pull-requests-limit: 0
• repository readback before this PR: vulnerability alerts enabled; Dependabot security updates enabled and unpaused; secret scanning enabled; push protection enabled; CodeQL default setup configured
• failed zero-job runs 33595399991, 33599284500, and 33599647449 each show GitHub's internal “unexpected error” annotation and a GitHub Support request ID; no workflow jobs were created
• run 33599348713 created jobs successfully from byte-identical orchestration content, disproving a deterministic workflow-file defect; its contributor-attribution check passed after the mapping was added
• uv run python scripts/audit_pr_attribution.py passes with all branch emails mapped
• uv run --extra dev python -m pytest tests/ci/test_classify_changes.py tests/scripts/test_contributor_map.py -q passes: 64 tests
• current exact head 45b165d693a1ebb3b2a1864dba4f2e2579a78e73 has started CI run 33599711145, which has successfully created jobs under the restored inherited ci.yaml identity
• full acceptance remains blocked until an independent reviewer applies ci-reviewed and all exact-head required checks complete

Documentation impact

The fork dependency policy remains documented beside the Dependabot setting. The contributor mapping is repository-maintenance data consumed by existing documented tooling. The diagnostic workflow-path experiment was fully reverted, so no CI documentation or README change is required. These changes do not alter setup, runtime, contribution behavior, or upstream product documentation.

Security boundary

This PR does not disable Dependabot alerts or security updates and does not change secret scanning, push protection, CodeQL, Actions permissions, dependencies, lockfiles, or executable CI behavior. Independent security review is required before merge; the workflow's ci-reviewed gate is intentionally left unsatisfied pending that review.

[github-actions]

૮ >ﻌ< ა ci review

_{running on fc35bb1 — chore(privacy): remove fork maintainer email attribution}

---

_{Still running 1 job: CI timing report}

❌ Job failures

Check contributors / check-attribution · View job

Job Check contributors / check-attribution failed.

---

⚠️ Action required

Unmapped contributor email(s) · View job

New contributor email(s) are not in AUTHOR_MAP.

rook@codevolt.co.uk (Rook)

How to fix:

Run from the PR branch:

python3 scripts/audit_pr_attribution.py --fix
git add contributors && git commit -m "chore: map contributor emails" && git push

Or map one email manually (do NOT edit AUTHOR_MAP in release.py):

python3 scripts/add_contributor.py <email> <github-username>

To find the GitHub username for an email:

gh api 'search/users?q=EMAIL+in:email' --jq '.items[0].login'

---

CI-sensitive file review · View job

This PR changes CI-sensitive files (eslint config, workflow YAMLs, or composite actions). These influence what the js-autofix job executes and pushes to main.

How to fix:

Add the ci-reviewed label after verifying:

• no new eslint rules with custom fix functions that write outside linted paths,
• no workflow changes that widen permissions or remove guards,
• no composite action changes that alter what gets executed.

---

⚠️ Warnings

OSV vulnerability scan · View job

28 known vulnerabilities found in pinned dependencies.

• CVE-2026-67213 in website/package-lock.json
• CVE-2026-82417 in scripts/whatsapp-bridge/package-lock.json
• CVE-2026-82417 in website/package-lock.json
• CVE-2026-75931 in package-lock.json
• CVE-2026-75931 in website/package-lock.json
• CVE-2026-83610 in package-lock.json
• CVE-2026-83610 in package-lock.json
• CVE-2026-71554 in uv.lock
• CVE-2026-73088 in package-lock.json
• CVE-2026-73088 in website/package-lock.json
• GHSA-8423-8fgw-73vq in uv.lock
• CVE-2026-70608 in package-lock.json
• CVE-2026-73089 in package-lock.json
• CVE-2026-73089 in website/package-lock.json
• CVE-2026-75975 in package-lock.json
• CVE-2026-75975 in website/package-lock.json
• CVE-2026-75899 in package-lock.json
• CVE-2026-75899 in website/package-lock.json
• CVE-2026-84371 in package-lock.json
• CVE-2026-56876 in package-lock.json

How to fix:

Review the findings in the Security tab. Update the affected dependencies if a patched version is available.

[Rook-CodeVolt]

Superseded by #8. The replacement preserves this PR and its diagnostic history, carries the same effective Dependabot diff as one noreply-authored commit, and avoids restoring a personal-email contributor mapping in the current tree. No history was rewritten; #8 remains draft and unmerged pending independent exact-head review and required checks.