Harden Dependabot: ignore unsafe bumps + align workflow docs

[mattrace-gloo]

Context

After the 2026-08-31 Dependabot queue pass:

• Merged #432 (@tanstack/react-query patch)
• Closed as unsafe / CI-red: #429 (react pin drift), #430 (Jest 30 + RTL 14), #431 (Babel 8 + ESLint 10), #433 (lucide-react-native major)

Closing does not ignore versions — the same React 19.2.3 → 19.2.8 bump already returned after #308. With open-pull-requests-limit: 5, these refill the queue and block safer updates.

Acceptance criteria

1. dependabot.yml ignores (npm ecosystem)

Add ignore rules so Dependabot stops opening PRs that we repeatedly close without a dedicated upgrade ticket:

• react, react-dom, react-test-renderer — ignore all version updates (keep Expo SDK 57 / RN 0.86 pin; today only major/minor are ignored for react / react-test-renderer, so patch drift still opens)
• jest, jest-*, @testing-library/react-native — ignore semver-major
• @babel/core, @babel/preset-env, @babel/runtime — ignore semver-major (Babel 8)
• eslint — ignore semver-major (ESLint 10)
• lucide-react-native — ignore semver-major

Document in a short comment in .github/dependabot.yml that these are intentional holds until dedicated upgrade tickets exist.

2. Align Dependabot agent docs with best practice

Update .cursor/rules/dependabot-workflow.mdc, docs/guides/dependabot-process.md, and .claude/commands/handle-dependabot.md so they agree:

• CI-first for safe PRs: required GitHub checks green is enough for lockfile-only / non-native patch bumps; local npm ci + doctor remains mandatory for risky / native / Expo ecosystem bumps
• GitHub Actions PRs: do not skip by default when Action pins + required checks are green (match historical merge of Actions SHA bumps)
• Resolution log: write batch notes in PR/issue comments; land docs/guides/dependabot-resolution-log.md via a ticketed chore PR — never commit on main
• Deferred upgrades: when closing a bot as “needs dedicated ticket”, either open that ticket (or link an existing one) or rely on the ignore rules above — do not leave orphan “needs ticket” comments with no tracker

3. Resolution log catch-up

• Commit the 2026-08-31 batch entry for Bump the react group with 4 updates #429–Bump lucide-react-native from 0.544.0 to 1.35.0 #433 / Bump @tanstack/react-query from 5.102.3 to 5.102.8 in the tanstack group #432 into docs/guides/dependabot-resolution-log.md on this ticket’s PR (local draft already exists on the agent machine)

Out of scope (separate tickets if/when we upgrade)

Do not implement these in this PR — only stop Dependabot from auto-opening them:

• React patch bump past Expo-aligned 19.2.3 (needs Android smoke)
• Jest 30 + Testing Library RN 14 migration
• Babel 8 + ESLint 10 tooling migration
• lucide-react-native v1 major + UI smoke

References

• Process: docs/guides/dependabot-process.md
• Rule: .cursor/rules/dependabot-workflow.mdc
• Config: .github/dependabot.yml
• Batch notes: 2026-08-31 Dependabot queue handling session