fix(ci): point Dependabot at develop, not main

[saadqbal]

Dependabot defaulted to the repo default branch (main), so the first bump batch (#327–#334) targeted main directly — bypassing develop and set to regress on the next promote. Adds target-branch: "develop" to both ecosystems so bumps ride the normal review + promote path. Existing PRs #327–#334 should be retargeted to develop (or closed and let Dependabot reopen them against develop).

🤖 Generated with Claude Code

---

Note

Low Risk
CI-only Dependabot configuration; no application or security logic changes.

Overview
Dependabot was opening dependency bumps against main (the repo default), which skipped develop and could regress on the next promote when develop still had older deps.

This change sets target-branch: "develop" on both gomod and github-actions update entries and documents that bumps should follow feature → develop → main. Existing Dependabot PRs that targeted main may need retargeting or reopening against develop.

^{Reviewed by Cursor Bugbot for commit f3f6564. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

👋 Heads-up — Code review queue is at 46 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• averaging-service#183 — docs: SafeTensors deployment-order & resume-safety runbook (epic feat(auth): logout revokes the token server-side (cli#112) #116) · author: @shujaatTracebloc · reviewer: @saadqbal
• averaging-service#184 — test(weights): shared SafeTensors golden-corpus drift guard + declare safetensors dep (SEC-03) · author: @LukasWodka · no reviewer assigned
• averaging-service#185 — test(weights): average a real SafeTensors edge + a legacy edge in one cycle — SEC-03 §8 · author: @LukasWodka · no reviewer assigned
• backend#1093 — chore(deps): bump django from 5.2.14 to 5.2.15 · author: @dependabot · no reviewer assigned
• backend#1118 — chore(release): promote develop → staging (week of 2026-07-13) · author: @aptracebloc · reviewer: @saadqbal, @saqlainsyed007
• backend#1119 — perf(api): cache ChoiceGroup + score-formula reference endpoints (#981 item 4, part 1) · author: @aptracebloc · reviewer: @saqlainsyed007
• cli#327 — chore(deps): bump actions/add-to-project from 1.0.2 to 2.0.0 · author: @dependabot · no reviewer assigned
• cli#328 — chore(deps): bump helm/kind-action from 1.10.0 to 1.14.0 · author: @dependabot · no reviewer assigned
• cli#329 — chore(deps): bump actions/upload-artifact from 4 to 7 · author: @dependabot · no reviewer assigned
• cli#330 — chore(deps): bump softprops/action-gh-release from 2 to 3 · author: @dependabot · no reviewer assigned

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)