ci: add monthly Dependabot for npm and github-actions

[0xcucumbersalad]

What

Adds .github/dependabot.yml with a monthly update schedule.

Ecosystems

• npm — root /, covers the Bun workspace (single root bun.lock spans all packages/* + examples/*). Grouped into one PR via all-dependencies. Limit 10.
• github-actions — bumps actions in .github/workflows/*. Grouped. Limit 5.

Notes

• Dependabot Bun support is GA; reads bun.lock directly.
• Grouping keeps monthly churn to ~2 PRs instead of one-per-dep.

---

Summary by cubic

Adds monthly Dependabot updates for npm (Bun workspace) and github-actions so we keep dependencies current with low churn. Previously we had no automated updates; now Dependabot will open grouped PRs once a month.

Dependencies

• npm at / uses a single bun.lock; all dependencies are grouped into one PR with a 10 PR cap.
• github-actions updates from .github/workflows/* are grouped into one PR with a 5 PR cap.
• Dependabot reads bun.lock directly; expect roughly two PRs per month.

^{Written for commit 313b927. Summary will update on new commits.}