ci: align the release pipeline and dependabot with the org standard (#2)

Brings the repo in line with the org standard (pg-partsmith as the reference), after today's redis-client-kit release uploaded a stale wheel.

- dependabot: `uv` + `github-actions`, one grouped PR a week each — the `pip` ecosystem never updated `uv.lock`

CI-only, no behaviour change in the package; no release is cut by this.

Author: AlexeyShalaev

.github/dependabot.yml

@@ -1,18 +1,22 @@
+# The actions the workflows run and the lock file are the two things that move
+# under this project without a commit of their own; each gets one grouped pull
+# request a week. uv, not pip: the pip ecosystem never updates uv.lock.
 version: 2
 updates:
-  - package-ecosystem: "pip"
-    directory: "/"
+  - package-ecosystem: github-actions
+    directory: /
     schedule:
-      interval: "weekly"
-      day: "monday"
+      interval: weekly
+      day: monday
     groups:
-      dev-dependencies:
-        dependency-type: "development"
-    open-pull-requests-limit: 5
+      actions:
+        patterns: ["*"]
 
-  - package-ecosystem: "github-actions"
-    directory: "/"
+  - package-ecosystem: uv
+    directory: /
     schedule:
-      interval: "weekly"
-      day: "monday"
-    open-pull-requests-limit: 5
+      interval: weekly
+      day: monday
+    groups:
+      dev:
+        dependency-type: development