chore(deps): regenerate poetry.lock and add Dependabot version updates

.github/dependabot.yml

@@ -0,0 +1,14 @@
+# Dependabot version updates. Configuration reference:
+# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+  # Dependabot reads Poetry projects (pyproject.toml + poetry.lock) through pip.
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/ci.yml

@@ -4,8 +4,7 @@ on:
     branches: [main]
   push:
     branches: [main]
-  # On-demand trigger: GitHub refuses to re-run a run older than 30 days, and
-  # both jobs relock against live PyPI, so drift is only observable on a fresh run.
+  # On-demand trigger: GitHub refuses to re-run a run older than 30 days.
   workflow_dispatch:
 
 jobs:
@@ -18,9 +17,8 @@ jobs:
         with:
           python-version: "3.10"
           cache: poetry
-      # Relock first: poetry.lock is stale vs pyproject.toml (the merged spec
-      # bump did not regenerate it).
-      - run: poetry lock
+      # Fail if poetry.lock is stale vs pyproject.toml; install what is committed.
+      - run: poetry check --lock
       - run: poetry install
       - run: poetry build
 
@@ -34,9 +32,8 @@ jobs:
         with:
           python-version: "3.10"
           cache: poetry
-      # Relock first: poetry.lock is stale vs pyproject.toml (the merged spec
-      # bump did not regenerate it).
-      - run: poetry lock
+      # Fail if poetry.lock is stale vs pyproject.toml; install what is committed.
+      - run: poetry check --lock
       - run: poetry install
       # No pytest suite yet; import-smoke the built package so CI fails fast
       # on broken codegen/spec dependencies.

.github/workflows/release.yml

@@ -30,8 +30,8 @@ jobs:
         with:
           python-version: "3.10"
           cache: poetry
-      # Relock first: poetry.lock is stale vs pyproject.toml (see ci.yml).
-      - run: poetry lock
+      # Fail if poetry.lock is stale vs pyproject.toml (see ci.yml).
+      - run: poetry check --lock
       - run: poetry install
       - run: poetry build
 
@@ -45,7 +45,7 @@ jobs:
         with:
           python-version: "3.10"
           cache: poetry
-      - run: poetry lock
+      - run: poetry check --lock
       - run: poetry install
       # No pytest suite yet; import-smoke the package (see ci.yml).
       - run: poetry run python -c "import utxorpc"