ci: monitor template dependencies with Dependabot

[mjun0812]

Overview and Background

This PR configures Dependabot to monitor the template's Python lockfile and pre-commit hooks. The repository-level configuration previously monitored only GitHub Actions, so dependency updates inside template/ were not discovered.

Related Issues

None.

Implementation Approach

Add dedicated uv and pre-commit update entries targeting /template in the repository configuration, while preserving the existing GitHub Actions entry. Add the corresponding pre-commit entry to the generated project's configuration, alongside its existing GitHub Actions and uv entries.

Changes

• Monitor template/uv.lock with the uv ecosystem.
• Monitor template/.pre-commit-config.yaml with the pre-commit ecosystem.
• Include pre-commit hook updates in generated projects.

Impact

Dependabot will open scheduled update pull requests for the template's lockfile and pre-commit hooks. Existing GitHub Actions and uv monitoring is preserved, and no dependency versions are changed by this PR.

Validation Results

• yq -e '.version == 2 and (.updates | length == 3)' .github/dependabot.yml — passed.
• yq -e '.version == 2 and (.updates | length == 3)' template/.github/dependabot.yml — passed.
• uvx --from copier copier copy --defaults ... template /private/tmp/dependabot-generated-direct — passed; generated .github/dependabot.yml contains the pre-commit entry.
• yq -e '.updates[] | select(.package-ecosystem == "pre-commit" and .directory == "/")' /private/tmp/dependabot-generated-direct/.github/dependabot.yml — passed.

[mjun0812]

Codex PR Review

Summary

This pull request adds Dependabot coverage for the template's uv lockfile and pre-commit hooks, and adds pre-commit monitoring to generated projects. No blocking findings were confirmed. The Contract axis was skipped because no spec source was available.

Verdict

APPROVE

Findings

N/A

---

Reviewed by Codex at 1e42e27