🔒 Refine coordinated dependency policy

[IsaacInsoll]

Summary

• remove the redundant packed-consumer Dependabot directory entry and its dead version-update configuration
• coordinate routine Vitest updates manually with Vite
• document that Vite builds the browser fixture behind zero-tolerance visual baselines
• retain the explicit packed-consumer audit as the concrete additional security gate

Context

Repository-level Dependabot security features are expected to cover tracked manifests independently of a routine version-update directory entry. The plan now records that expectation for confirmation when a real alert occurs instead of claiming the removed entry created coverage.

The packed-consumer preflight still rejects Vite drift. Keeping its Vite version aligned remains a realism policy; the stronger reason for manual Vite/Vitest review is their role in the maintained test and visual environments.

Verification

• npm run format:check
• npm run lint
• parsed .github/dependabot.yml with Ruby Psych
• git diff --check