fix(dependabot): trim to real ecosystems (cargo + github-actions)

The template config kept mix/npm/pip/nix update entries, but this repo has
no such manifests (flake.nix was removed in #26, nix→guix) — producing 5
failing dependabot dynamic runs per cycle (all failed 2026-06-29). Trim to
the two ecosystems that exist. Pure config-truth fix; cargo security PRs
still flow (open-pull-requests-limit: 0 preserved).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: hyperpolymath

.github/dependabot.yml

@@ -1,6 +1,8 @@
 # SPDX-License-Identifier: MPL-2.0
-# Dependabot configuration for RSR-compliant repositories
-# Covers common ecosystems - remove unused ones for your project
+# Dependabot configuration — trimmed to the ecosystems that actually exist
+# in this repo (Rust + GitHub Actions). The template's mix/npm/pip/nix
+# entries produced 5 failing dynamic runs per cycle against manifests that
+# do not exist (flake.nix was removed in #26, nix→guix).
 
 version: 2
 updates:
@@ -21,31 +23,7 @@ updates:
       interval: "weekly"
     # `open-pull-requests-limit: 0` suppresses routine version-update PRs
     # while leaving Dependabot SECURITY PRs flowing. The previous
-    # `ignore: "*" patch` rule also silenced security PRs under GitHub\'s
+    # `ignore: "*" patch` rule also silenced security PRs under GitHub's
     # current Dependabot behaviour. See rsr-template-repo commit 78b050e
     # and 007-lang/audits/audit-dependabot-automation-gap-2026-04-17.md.
     open-pull-requests-limit: 0
-
-  # Elixir/Mix
-  - package-ecosystem: "mix"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-
-  # Node.js/npm
-  - package-ecosystem: "npm"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-
-  # Python/pip
-  - package-ecosystem: "pip"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-
-  # Nix flakes
-  - package-ecosystem: "nix"
-    directory: "/"
-    schedule:
-      interval: "weekly"