chore(deps): add dependabot config with 7-day cooldown

[migmartri]

Adds a Dependabot version-update configuration, which the repository did not previously have.

• Enables weekly version updates for the root Go module (covering the control plane, CLI, artifact CAS, and shared pkg libraries).
• Applies a 7-day cooldown so newly published versions are not proposed immediately, reducing exposure to freshly released or potentially compromised releases.
• Groups minor and patch bumps into a single PR to reduce noise; major updates remain individual PRs.

This change was assisted by Claude Code.

[chainloop-platform]

AI Session Analysis

Avg score	Sessions	Failing policies	Attribution	Files	Lines	Total Duration
🟢 84%	1	✅ 0	100% AI / 0% Human	1	+31 / -0	4m52s

🟢 84% — 100% AI — ✅ All policies passing

Jun 8, 2026 08:59 UTC · 4m52s · $2.36 · 65.0k in / 16.4k out · claude-code 2.1.168 (claude-opus-4-8)

View session details ↗

Change Summary

• Adds .github/dependabot.yml for the root Go module.
• Configures weekly Go dependency updates with a 7-day cooldown.
• Groups minor and patch bumps and sets dependency labels and commit prefix.

AI Session Overall Score

🟢 84% — Clean session with strong scoping; only end-to-end verification was missing.

AI Session Analysis Breakdown

🟢 96% · scope-discipline

🟢 It asked for scope approval before deciding covered ecosystems. · High Impact

🟢 92% · alignment

🟢 It honored signed-commit policy and retried without bypassing it. · Medium Impact

🟢 90% · context-and-planning

🟢 It inspected the upstream PR and local repo before editing. · High Impact

🟢 89% · solution-quality

No notes.

🟢 86% · user-trust-signal

No notes.

🟡 64% · verification

🟠 YAML syntax was checked, but Dependabot behavior was never exercised end-to-end. · Medium Severity

💡 For config changes, make verification mean watching the new path run, not just parsing the file.

---

File Attribution

████████████████████ 100% AI / 0% Human

Status	Attribution	File	Lines
created	ai	.github/dependabot.yml	+31 / -0

---

Policies (4)

Status	Policy	Material	Messages
✅ Passed	ai-config-ai-agents-allowed	ai-coding-session-8d8f75	-
✅ Passed	ai-config-no-dangerous-commands	ai-coding-session-8d8f75	-
✅ Passed	ai-config-no-secrets	ai-coding-session-8d8f75	-
✅ Passed	ai-config-mcp-servers-allowed	ai-coding-session-8d8f75	-

---

Powered by Chainloop and Chainloop Trace

[cubic-dev-ai]

No issues found across 1 file

_{Re-trigger cubic}