[katbyte]

Group Dependabot updates into one PR per ecosystem and run the checks monthly instead of weekly.

Why: every dependency bump currently opens its own PR, and each one costs a full CI run and a separate review. Batching cuts that to one PR per ecosystem per check.

Every update entry gets a catch-all group. Dependabot only batches when an entry has a groups block, and none of the entries had one. Groups added: github-actions, go-modules, go-tools.

   - package-ecosystem: "gomod"
     directory: "/"
     schedule:
       interval: "weekly"
     cooldown:
       default-days: 7
+    groups:
+      go-modules:
+        patterns:
+          - "*"

Checks run monthly instead of weekly. Every entry that was on a weekly schedule now runs monthly, so batched PRs arrive once a month per ecosystem. The quarterly .tools entries already check less often than that and are unchanged.

   - package-ecosystem: "gomod"
     directory: "/"
     schedule:
-      interval: "weekly"
+      interval: "monthly"

Things that are fine as they are

• Security updates are not grouped. They still open as their own PRs, so a CVE fix is never held up by or tangled with routine bumps. Adding applies-to: security-updates to a group would change that, and was deliberately left out.
• Cooldowns and ignore rules are unchanged.
• If one dependency in a group fails to update, Dependabot still opens the PR with the rest.