chore(deps): align Dependabot config with the org supply chain baseline

.github/dependabot.yml

@@ -1,43 +1,52 @@
-# Grouped per ecosystem, with a five-day cooldown as a supply-chain control: most malicious releases
-# are detected and yanked within hours. Security updates are advisory-driven and ignore the cooldown.
-
+# Follows the matchory supply chain baseline:
+# https://github.com/matchory/.github/blob/main/supply-chain/STANDARD.md
+#
+#   - cooldown: a release must be 3 days old before Dependabot proposes it
+#     (does not delay security updates)
+#   - minor + patch updates arrive as ONE grouped PR per ecosystem
+#   - major updates are never grouped: one PR per dependency, reviewed on its own
+#   - security updates get their own group per ecosystem
 version: 2
 
-multi-ecosystem-groups:
-  app:
-    schedule:
-      interval: weekly
-  github-actions:
-    schedule:
-      interval: weekly
-
 updates:
-  - package-ecosystem: uv
-    multi-ecosystem-group: app
+  - package-ecosystem: github-actions
     directory: /
-    patterns:
-      - '*'
+    schedule:
+      interval: weekly
+      day: monday
+      time: "05:00"
+      timezone: Europe/Berlin
     cooldown:
-      default-days: 5
-    labels:
-      - dependencies
+      default-days: 3
+      semver-major-days: 3
+      semver-minor-days: 3
+      semver-patch-days: 3
     groups:
+      minor-and-patch:
+        applies-to: version-updates
+        update-types: [minor, patch]
       security:
         applies-to: security-updates
-        patterns:
-          - '*'
+        patterns: ["*"]
+    labels: [dependencies, github-actions]
 
-  - package-ecosystem: github-actions
-    multi-ecosystem-group: github-actions
+  - package-ecosystem: uv
     directory: /
-    patterns:
-      - '*'
+    schedule:
+      interval: weekly
+      day: monday
+      time: "05:00"
+      timezone: Europe/Berlin
     cooldown:
-      default-days: 5
-    labels:
-      - dependencies
+      default-days: 3
+      semver-major-days: 3
+      semver-minor-days: 3
+      semver-patch-days: 3
     groups:
+      minor-and-patch:
+        applies-to: version-updates
+        update-types: [minor, patch]
       security:
         applies-to: security-updates
-        patterns:
-          - '*'
+        patterns: ["*"]
+    labels: [dependencies, python]