chore(deps): tighten dependabot policy — block majors + lock lint plugins

Adapted from common large-org practice for taming dependabot noise.

Two policy layers, applied to every npm ecosystem (root, packages/core,
packages/mantine, and the github-actions block):

1. Global semver-major block. Major bumps need hands-on evaluation —
   breaking changes, peer-dep ripples, migration cost. They never
   auto-PR; bump manually when time permits. (Already saw this with
   @Mantine 9.x x4 + TypeScript 6.0 in last week's batch.)

2. Lint / typecheck plugin minor lock — applied to:
   - eslint
   - eslint-plugin-*
   - @typescript-eslint/*
   - typescript-eslint
   - typescript
   These tools routinely add new rules on minor bumps that flag
   previously-passing code. ESLint's own SemVer policy explicitly says
   "rule improvements → more errors → minor". Locking auto-PRs to patch
   keeps CI green; we'll bump minors manually when ready to address new
   violations.

The trigger was eslint-plugin-react-hooks 7.0.1 → 7.1.0 (April 2026),
which improved set-state-in-effect / ref-during-render detection and
made the compiler report all errors instead of stopping at the first.
20+ new diagnostics surfaced in our MarkdownContent block-memo code,
where render-time ref reads are by design for cache lookup.

Dependabot will re-generate the dev-deps batch shortly without
react-hooks 7.x minors. PR #12 closed as superseded by this policy.

Author: AIEPhoenix

.github/dependabot.yml

@@ -1,4 +1,19 @@
 version: 2
+
+# Shared ignore policy (copied verbatim across the three npm ecosystems
+# because dependabot.yml does not support YAML anchors at the top level).
+#
+# - Major bumps across the dependency graph: blocked. Breaking changes,
+#   peer-dep ripples, and migration cost need hands-on evaluation; we
+#   bump majors manually.
+# - Lint / typecheck plugins (eslint, eslint-plugin-*, @typescript-eslint,
+#   typescript itself): minors blocked. These tools routinely add new
+#   rules on minor bumps that flag previously-passing code; locking to
+#   patch keeps CI green. We'll bump minors manually when we have time
+#   to address new violations. (See eslint-plugin-react-hooks 7.0→7.1,
+#   April 2026, which broke MarkdownContent.tsx with 20+ new ref/effect
+#   diagnostics — none of which were API changes.)
+
 updates:
   # npm dependencies in the monorepo root (devDeps: storybook, vitest, eslint, etc.)
   - package-ecosystem: npm
@@ -11,8 +26,26 @@ updates:
     open-pull-requests-limit: 5
     labels:
       - dependencies
+    ignore:
+      - dependency-name: '*'
+        update-types:
+          - version-update:semver-major
+      - dependency-name: 'eslint'
+        update-types:
+          - version-update:semver-minor
+      - dependency-name: 'eslint-plugin-*'
+        update-types:
+          - version-update:semver-minor
+      - dependency-name: '@typescript-eslint/*'
+        update-types:
+          - version-update:semver-minor
+      - dependency-name: 'typescript-eslint'
+        update-types:
+          - version-update:semver-minor
+      - dependency-name: 'typescript'
+        update-types:
+          - version-update:semver-minor
     groups:
-      # Group all minor / patch dev-deps into one PR per week
       dev-deps:
         dependency-type: development
         update-types:
@@ -31,6 +64,25 @@ updates:
     labels:
       - dependencies
       - 'scope:core'
+    ignore:
+      - dependency-name: '*'
+        update-types:
+          - version-update:semver-major
+      - dependency-name: 'eslint'
+        update-types:
+          - version-update:semver-minor
+      - dependency-name: 'eslint-plugin-*'
+        update-types:
+          - version-update:semver-minor
+      - dependency-name: '@typescript-eslint/*'
+        update-types:
+          - version-update:semver-minor
+      - dependency-name: 'typescript-eslint'
+        update-types:
+          - version-update:semver-minor
+      - dependency-name: 'typescript'
+        update-types:
+          - version-update:semver-minor
     groups:
       runtime-deps:
         dependency-type: production
@@ -50,18 +102,41 @@ updates:
     labels:
       - dependencies
       - 'scope:mantine'
+    ignore:
+      - dependency-name: '*'
+        update-types:
+          - version-update:semver-major
+      - dependency-name: 'eslint'
+        update-types:
+          - version-update:semver-minor
+      - dependency-name: 'eslint-plugin-*'
+        update-types:
+          - version-update:semver-minor
+      - dependency-name: '@typescript-eslint/*'
+        update-types:
+          - version-update:semver-minor
+      - dependency-name: 'typescript-eslint'
+        update-types:
+          - version-update:semver-minor
+      - dependency-name: 'typescript'
+        update-types:
+          - version-update:semver-minor
     groups:
       runtime-deps:
         dependency-type: production
         update-types:
           - minor
           - patch
 
-  # GitHub Actions used in workflows
+  # GitHub Actions used in workflows — major-block only; no lint-plugin lock needed.
   - package-ecosystem: github-actions
     directory: /
     schedule:
       interval: monthly
     labels:
       - dependencies
       - 'scope:ci'
+    ignore:
+      - dependency-name: '*'
+        update-types:
+          - version-update:semver-major