ci(deps): group Dependabot updates into one PR per ecosystem (#1357)

The 2026-08-10 refresh opened 17 PRs: ten gomod, four npm, three actions.
Each one rewrites its ecosystem's lockfile, so merging any single PR
invalidates every sibling, which then rebases and re-runs the full ~15
minute CI matrix. Clearing the batch sequentially costs 17 CI cycles for
one weekly dependency refresh.

A catch-all group per ecosystem makes that 4 PRs at most. It also keeps
release trains intact -- the seven OpenTelemetry modules in that batch are
one coordinated release and belong in one PR.

The stryker and vitest groups are removed because the npm catch-all
subsumes them; their reason for existing (exact peer pins across a family
break under a partial merge) is now the rationale for the whole scheme and
is recorded at the top of the file.

Majors are already ignored for every ecosystem, so each group only ever
carries patch and minor updates. A bad member goes on the ignore list
rather than ungrouping the rest.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

.github/dependabot.yml

@@ -1,5 +1,20 @@
 version: 2
 
+# Every ecosystem groups its updates into a single PR. Splitting per package
+# means each ecosystem's lockfile (go.sum, package-lock.json, Cargo.lock) is
+# rewritten once per PR, so merging any one of them invalidates all the rest —
+# every sibling then rebases and re-runs the full ~15 minute CI matrix. The
+# 2026-08-10 batch opened 17 PRs for one weekly refresh.
+#
+# Grouping also keeps release trains together. The OpenTelemetry modules move
+# in lockstep, and npm families version-lock their own packages with exact peer
+# pins (typescript-checker@9.6.0 requires core@9.6.0, not ^9.6.0), so a partial
+# merge is an ERESOLVE failure waiting to happen.
+#
+# Majors are ignored everywhere below, so each group only ever carries patch and
+# minor updates. If one member of a group is bad, add it to that ecosystem's
+# ignore list rather than ungrouping the rest.
+
 updates:
   # Go server dependencies
   - package-ecosystem: gomod
@@ -13,6 +28,10 @@ updates:
       - dependencies
       - go
     open-pull-requests-limit: 10
+    groups:
+      go-dependencies:
+        patterns:
+          - "*"
     ignore:
       - dependency-name: "*"
         update-types: ["version-update:semver-major"]
@@ -29,18 +48,10 @@ updates:
       - dependencies
       - npm
     open-pull-requests-limit: 10
-    # These families version-lock their own packages with exact peer pins
-    # (e.g. typescript-checker@9.6.0 requires core@9.6.0, not ^9.6.0), so a
-    # PR-per-package split guarantees an ERESOLVE failure whenever only some
-    # of them are merged. Group each family into a single PR.
     groups:
-      stryker:
+      npm-dependencies:
         patterns:
-          - "@stryker-mutator/*"
-      vitest:
-        patterns:
-          - "vitest"
-          - "@vitest/*"
+          - "*"
     ignore:
       - dependency-name: "*"
         update-types: ["version-update:semver-major"]
@@ -57,6 +68,10 @@ updates:
       - dependencies
       - rust
     open-pull-requests-limit: 5
+    groups:
+      cargo-dependencies:
+        patterns:
+          - "*"
     ignore:
       - dependency-name: "*"
         update-types: ["version-update:semver-major"]
@@ -73,6 +88,10 @@ updates:
       - dependencies
       - ci
     open-pull-requests-limit: 5
+    groups:
+      actions-dependencies:
+        patterns:
+          - "*"
     ignore:
       - dependency-name: "*"
         update-types: ["version-update:semver-major"]