[eitsupi]

Part of #1732.

Adds the npm ecosystem (used by Dependabot for pnpm projects) to .github/dependabot.yml, replacing the TODO left in #1771.

• Weekly schedule with a 7-day cooldown, matching the GitHub Actions configuration.
• Patch updates are grouped separately for production and development dependencies; minor and major updates arrive one per PR.
• @types/vscode is ignored so that it keeps tracking the minimum supported VS Code API and is bumped together with engines.vscode.
• Major updates of @types/node are ignored so that it keeps tracking the Node.js version bundled with VS Code.
• Commits use the chore: prefix, so dependency bumps are skipped by git-cliff.

The repository uses pnpm 11 with a single-document pnpm-lock.yaml, which Dependabot supports (dependabot/dependabot-core#14794).

[renkun-ken]

Reviewed commit 0595518. No actionable issues found.

The production/development groups correctly cover patch updates without needing explicit patterns; minor and major updates remain individual PRs. The ignore rules preserve manual control of @types/vscode and the Node typings major, and the chore: prefix matches the existing git-cliff exclusion.

Validated the exact changed YAML against the Dependabot schema, checked the manifest/workspace settings and single-document lockfile, and verified the option semantics against GitHub's documentation and Dependabot's matching implementation. GitHub has also officially confirmed pnpm 11 support.

All six existing CI checks are green. A hosted Dependabot update job was not run as part of this review.