ci: deduplicate Dependabot PRs in monorepo via group-by

[martyy-code]

Problem

Dependabot currently generates 2× PRs per bump for dependencies present in workspaces (apps/web, packages/type-testing). Root cause: the groups block in .github/dependabot.yml lacks group-by: dependency-name, so the same dep in N workspaces → N PRs.

Result: 20 open PRs, ~17 are root/workspace duplicates.

Solution

1. Add group-by: dependency-name to both groups (production-dependencies + development-dependencies) in .github/dependabot.yml — collapses PRs on the next weekly run
2. Enable auto-merge — Settings → General → "Allow auto-merge" + create .github/workflows/dependabot-auto-merge.yml to auto-merge minor/patch Dependabot PRs after CI passes (excluding majors)
3. Clean up the current stack — merge workspace PRs first, then close the duplicate root PRs

Acceptance Criteria

• group-by: dependency-name added → next Dependabot run generates ≤ 10 PRs (one per dep)
• 20 open Dependabot PRs merged or closed
• Auto-merge workflow active and functional
• versioning-strategy for the published lib (packages/type-testing/) evaluated separately

Related

• Learning doc: docs/internal/learnings/github/dependabot-pnpm-monorepo-2026.md
• Open PRs: chore(ci): Bump the github-actions group with 5 updates #13, chore(deps-dev)(deps-dev): Bump the development-dependencies group across 2 directories with 7 updates #15, chore(deps-dev)(deps-dev): Bump vitest from 2.1.9 to 4.1.10 #17–chore(deps)(deps): Bump the production-dependencies group across 2 directories with 13 updates #33 (Dependabot stack)

Risks

• Low. group-by is a one-line addition; the rest is manual cleanup.
• The auto-merge workflow requires "Allow auto-merge" enabled on the repo + branch protection on main (verify this is already in place).

[martyy-code]

Triage complete

• Type: Task
• Area: area:ci
• Status: ready
• Priority: Medium
• Effort: Low

Verification: CONFIRMED — .github/dependabot.yml has groups for both production-dependencies and development-dependencies but neither has group-by: dependency-name. Without it, Dependabot opens one PR per workspace for each dep bump — consistent with the 20 open Dependabot PRs currently in the repo. No auto-merge workflow exists. The learning doc at docs/internal/learnings/github/dependabot-pnpm-monorepo-2026.md validates the fix.

Next steps: This issue is ready to be picked up. The core fix is a one-line addition (group-by: dependency-name) to each group in .github/dependabot.yml. The auto-merge workflow and current PR cleanup are follow-on steps.

Related: #44 (staging branch) is blocked by this — once group-by lands and the staging branch exists, the same .github/dependabot.yml will need target-branch: staging.

Triage by @martyy-code.