chore(dependabot): disable auto-rebase to avoid CI cascade

When one Dependabot PR merges and main advances, Dependabot's default
behavior is to auto-rebase all its other open PRs by force-pushing onto
each. With the Deploy Preview environment gate, every force-push
invalidates the prior approval and triggers a fresh CI run — turning N
sibling PRs into roughly O(N^2) workflow runs. The /dependabot-review
skill already rebases on demand (`gh pr update-branch`, or commenting
`@dependabot rebase` if conflicts) so disabling auto-rebase doesn't lose
any capability — it just lets the skill control when rebases happen.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: sserrata

.github/dependabot.yml

@@ -6,6 +6,11 @@ updates:
       interval: weekly
     cooldown:
       default-days: 7
+    # Prevent the rebase cascade that fires when one PR merges and Dependabot
+    # force-pushes rebases onto all sibling PRs (each force-push invalidates
+    # env-gate approvals and re-runs CI). The /dependabot-review skill still
+    # rebases on demand via `gh pr update-branch` when needed.
+    rebase-strategy: disabled
     groups:
       react:
         patterns:
@@ -18,3 +23,4 @@ updates:
       interval: weekly
     cooldown:
       default-days: 7
+    rebase-strategy: disabled