Agentic software factory Part 15: Replace Dependabot PRs with issue-filing sweeps; SDK watch; the factory overview

[cliffhall]

Part of the agentic software factory tracker #4858, Wave 6. Proposed as S13 in docs/agent-guidance-inception.md (PR #4861) §9, from #4859.

Depends on

After Part 6 (board-ops/issue-create) and Part 14 (#4873), which creates scripts/lib/action-refs.mjs, the SHA matcher this issue's dependency-refresh imports.

Scope

• Turn off automated security-fix PRs. This is a repo setting, and it's enabled today. Delete .github/dependabot.yml, which opens weekly Actions PRs. Keep Dependabot alerts on.
• Add three sweeps, adapted from the Inspector:
  • dependency-refresh: monthly, covering npm workspaces, each uv.lock and Actions
  • dependabot-alerts: daily, covering npm and pip, re-checked against v2/main
  • sdk-watch: nightly, covering the TS SDK packages and Python mcp
• sdk-watch's LLM analysis job keeps the Inspector's hardening unchanged: three jobs split by permission, no Bash, output scanned before upload and before posting.
• dependency-refresh.mjs imports the SHA matcher from scripts/lib/action-refs.mjs (extracted by Part 14) instead of defining it.
• Keep Part 14's SHA pins current: dependency-refresh ranks each pin by its # vX.Y.Z comment, as the Inspector's sweep does. Part 14 (Agentic software factory Part 14: v2/main → main milestone release flow and release skill #4873) adds the pins and verify:action-pins before the first release.
• Add the AGENTS.md rules: dependency updates are issue-driven, and Remove Part 2's temporary Dependabot exception to "every PR references an issue".
• Work down the existing Dependabot PR backlog (six open at the time of writing: chore(deps): bump the uv group across 3 directories with 1 update #4615, chore(deps): bump actions/github-script from 8 to 9 #4613, chore(deps): bump actions/checkout from 6 to 7 #4612, chore(deps): bump ip-address from 10.2.0 to 10.4.0 in the npm_and_yarn group across 1 directory #4609, chore(deps): bump the uv group across 3 directories with 2 updates #3748, chore(deps): bump minimatch from 10.0.1 to 10.2.1 in the npm_and_yarn group across 1 directory #3377). Convert each still-needed bump into an issue for the sweep flow, and close the PR with a pointer to it.

Acceptance criteria

• No new Dependabot PRs open after merge.

• Every Dependabot PR open at merge time is closed, with a pointer to its replacement issue or a reason.

• A dry run of each sweep writes nothing and prints the issue payload it would file, with correct labels and milestone.

• Live filing is covered by script tests with a mocked gh, not against the real tracker.

• The script tests pass.

• A closing docs/ai-software-factory.md for this repo, written once the whole factory, this automation included, has landed.

Branch

Targets v2/main. Closes #N won't auto-close an issue on a non-default branch, so close this one by hand on merge and move the card to Done.