chore: fix Dependabot version-bump gate and stop tightening squawk-cli

[stephen-kintsugi]

Summary

Follow-ups surfaced by the first Dependabot PRs (#12, #13):

• Exempt Dependabot from the version-bump gate (ci.yml): the "version must differ from main" check fails on any Dependabot pip PR, because Dependabot edits pyproject.toml (dependency constraints) but never bumps the package version. Skipped for dependabot[bot]; dependency changes roll into the next release.
• Stop tightening squawk-cli (dependabot.yml): versioning-strategy: increase was raising the intentional >=2.0 floor (e.g. to >=2.61.0), which would force consumers off their own additional_dependencies pins. Now ignored.

Also created the missing dependencies label so Dependabot can apply it.

Notes

• After this merges, Dependabot re-runs and chore(deps): bump the python-packages group with 6 updates #13 comes back clean (no squawk-cli bump, gate passes).

---

Note

Low Risk
Only GitHub Actions and Dependabot configuration change; no application or release runtime behavior.

Overview
Fixes two issues that were blocking or breaking Dependabot pip PRs.

Dependabot now ignores squawk-cli updates so versioning-strategy: increase cannot raise the deliberate >=2.0 constraint (which would override consumers’ additional_dependencies pins).

CI still requires pyproject.toml and __init__.py versions to match, but skips the “package version must differ from main” gate when the PR author is dependabot[bot] (using pull_request.user.login, not github.actor, so Update-branch pushes do not re-enable the check).

^{Reviewed by Cursor Bugbot for commit 86800bd. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1c6845a. Configure here.}

[cursor]

PR Risk Assessment

Risk level: Very Low
Review required: No
Reviewers assigned: None (jaykintsugi already requested via CODEOWNERS; no additional assignment needed)
Action taken: Approved

Rationale: The diff only touches .github/dependabot.yml (ignore squawk-cli so Dependabot does not tighten the intentional >=2.0 floor) and .github/workflows/ci.yml (exempt dependabot[bot] PRs from the version-bump gate, keyed on pull_request.user.login rather than github.actor). No production/runtime code paths change; blast radius is limited to CI gating and Dependabot behavior in this repo, and both edits are trivially reversible.

No production code changes — test coverage gate does not apply.

Re-evaluated after the follow-up commit fixing the Dependabot exemption to use PR author instead of github.actor; incremental change is a correctness fix with no material risk increase.

---

risk_level: Very Low
review_required: false
reviewers: []
action_taken: approved
rationale: CI workflow and Dependabot config only (.github/workflows/ci.yml, .github/dependabot.yml); exempts bot PRs from version-bump gate and stops squawk-cli constraint tightening — no production code or runtime behavior change.

  

_{Sent by Cursor Automation: Assign PR reviewers & Assess Risk & Approve if Safe}

[cursor]

PR Risk Assessment (re-evaluated after synchronize)

Risk level: Very Low
Review required: No
Reviewers assigned: None (no review required)
Action taken: No approval action — an active approval already exists on the current head, so no new approval was submitted.

Re-evaluation: The new commit (86800bd) is a merge of main into the branch, bringing in the poetry 2.5.1 / python 3.13 tooling updates from #17. This is branch healing with no change to the PR's own logic: the substantive diff remains confined to .github/dependabot.yml (ignore squawk-cli so Dependabot cannot tighten the intentional >=2.0 floor) and .github/workflows/ci.yml (exempt dependabot[bot] PRs from the version-bump gate, keyed on pull_request.user.login). No production/runtime code changes — the test-coverage gate does not apply. No importlinter.toml changes.

risk_level: Very Low
review_required: false
reviewers: []
action_taken: no_action
rationale: Diff touches only .github/dependabot.yml and .github/workflows/ci.yml (CI gating + Dependabot config, no production code); the new commit is a merge of main (branch healing, no logic change). PR already has an active approval on head 86800bd, so no re-approval was needed.

  

_{Sent by Cursor Automation: Assign PR reviewers & Assess Risk & Approve if Safe}