ci: add dependabot and nix flake update workflows [ENG-11704]

[ryoppippi]

Summary

• Add dependabot.yaml for automated dependency updates
  • Python dependencies (pip) with weekly schedule on Mondays
  • GitHub Actions with weekly schedule
  • Groups dev dependencies and AI framework dependencies
• Add nix-flake-update.yaml workflow (aligned with stackone-ai-node)
  • Scheduled weekly Nix flake input updates
  • Auto-creates PR with merge enabled

Test plan

• Dependabot creates PRs for outdated dependencies
• Nix flake update workflow runs successfully on schedule or manual trigger

---

Summary by cubic

Add Dependabot and a scheduled Nix flake update workflow to automate dependency updates for Python, GitHub Actions, and Nix. This keeps dependencies current with weekly PRs and auto-merge when safe.

• New Features
  • Dependabot for pip and GitHub Actions, weekly Mondays at 09:00 Europe/London; groups dev and AI framework updates (minor/patch) with labels and PR limits.
  • Scheduled Nix flake update (cron + manual) that updates flake.lock, opens a labeled PR via peter-evans, and enables auto-merge.

^{Written for commit e97c290. Summary will update automatically on new commits.}

[Copilot]

Pull request overview

This PR adds automated dependency management tooling for the repository by introducing Dependabot configuration for Python and GitHub Actions dependencies, and a scheduled Nix flake update workflow. These additions align with the goal of keeping dependencies current with minimal manual intervention.

Key Changes:

• Dependabot configuration with weekly schedules for Python (pip) and GitHub Actions dependencies, grouping dev and AI framework updates
• Automated Nix flake update workflow that runs weekly, creating PRs with auto-merge enabled
• Both automation workflows scheduled for Mondays at 09:00 to coordinate dependency updates

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.

File	Description
.github/dependabot.yaml	Configures Dependabot for weekly Python and GitHub Actions dependency updates with grouped minor/patch updates for dev dependencies and AI frameworks
.github/workflows/nix-flake-update.yaml	Implements scheduled workflow to automatically update Nix flake inputs weekly and create PRs with auto-merge enabled

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Inconsistent version pinning for actions/checkout. This workflow uses v4.3.1, but all other workflows in the repository use v6.0.1 (commit hash 8e8c483db84b4bee98b60c0593521ed34d9990e8). For consistency and to use the same version as the rest of the codebase, this should be updated to match the version used in ci.yaml, release.yaml, and nix-flake.yaml.

Suggested change

	uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
	uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

[Copilot]

The pattern "gitleaks" is included in the dev-dependencies group, but gitleaks is not a Python package managed by pip. It's a standalone tool installed via Nix (as seen in the justfile and CI workflows). This pattern will not match any Python dependencies and should be removed from the dev-dependencies group.

Suggested change

- "gitleaks"

[Copilot]

The pattern "pre-commit" is included in the dev-dependencies group, but pre-commit is not a Python package managed by pip in this project. It's managed via the git-hooks.nix flake module (see flake.nix). This pattern will not match any Python dependencies and should be removed from the dev-dependencies group.

Suggested change

- "pre-commit"

[cubic-dev-ai]

No issues found across 2 files

[glebedel]

LGTM