chore(v2.5): route and reconcile Dependabot updates through dev

[dmidlo]

Problem

Dependabot currently omits target-branch: dev for both configured ecosystems, so grouped updates #730 and #731 target stale main contrary to repository workflow. Their CI then fails because versioned workflow/dependency pins move without the repository contract-test assertions, and the Python group does not update uv.lock.

SemVer

Patch-level dependency/tooling maintenance within the unreleased v2.5 line. No public API break is authorized.

Acceptance

• configure both Dependabot ecosystems to target dev;
• reconcile the intended changes from chore(deps): bump the github-actions group across 1 directory with 5 updates #730 and chore(deps): bump the python-packaging group across 1 directory with 22 updates #731 onto dev;
• update exact contract-test assertions with the reviewed pins;
• regenerate and validate uv.lock;
• prove the scientific implementation identity used by frozen RC15 remains isolated and unchanged;
• run targeted dependency/workflow tests, the full pre-commit battery, full pytest, package build/wheel smoke, and local-simple-registry TestPyPI preflight;
• push the verified Commitizen commit to origin/dev;
• close or retarget superseded PRs only after tree-equivalence evidence proves their intended updates are preserved.

[dmidlo]

Implemented and pushed to dev in commit 4759b52 (fix(deps): route dependabot updates through dev).

Delivered:

• routed both Dependabot ecosystems to dev;
• integrated the exact workflow payload from chore(deps): bump the github-actions group across 1 directory with 5 updates #730 and dependency declarations from chore(deps): bump the python-packaging group across 1 directory with 22 updates #731;
• regenerated and committed uv.lock with 221 resolved packages and all 22 intended exact dependency versions;
• updated contract tests for the routed policy and pins;
• verified byte-for-byte equivalence with the source PR payloads, then closed chore(deps): bump the github-actions group across 1 directory with 5 updates #730 and chore(deps): bump the python-packaging group across 1 directory with 22 updates #731 as superseded.

Validation:

• uv lock --check: passed;
• focused distribution/release tests: 17 passed;
• actionlint: passed;
• full pre-commit battery: passed;
• full pytest suite: 2,460 passed, 5 skipped in 31m17s;
• sdist and wheel build plus Twine checks: passed;
• wheel metadata/runtime provisioning smoke: passed;
• local-simple TestPyPI preflight: passed, including clean install, Temporal 1.31.0 runtime provisioning/start/stop, default routing, quality workflow smoke, and download smoke;
• commit-time and pre-push hooks: passed;
• origin/dev now contains 4759b52 and the worktree is clean.