fix(ci): group Dependabot updates into one PR per ecosystem

Without a groups: block Dependabot opens ONE PR PER DEPENDENCY. Every one of
those PRs re-fires every workflow in the repo, so a single estate-wide bump
(e.g. actions/checkout 7.0.0 -> 7.0.1) fans out into N PRs x M workflow runs
of notifications. This was a measurable amplifier of the notification storm.

Grouping with patterns: ["*"] makes the same bump a single PR, matching the
223 estate repos that already do this.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: hyperpolymath

.github/dependabot.yml

@@ -6,4 +6,11 @@ updates:
     schedule:
       interval: "daily"
     open-pull-requests-limit: 10
+    # Batch this ecosystem into a single PR. Ungrouped, Dependabot
+    # opens one PR per dependency, and each PR re-fires every
+    # workflow in the repo.
+    groups:
+      github-actions:
+        patterns:
+          - "*"