chore(deps): declare the npm ecosystem for Dependabot

[BharathASL]

Description

Dependabot here watched github-actions and nothing else, so @resvg/resvg-js and archiver — the two runtime dependencies this repository ships against, with a committed lockfile — were unwatched. The 0 open Dependabot alerts this repository reports is a consequence of nothing looking, not of a clean tree.

templates/dependabot.template leaves this decision to each repository and asks that it be made "only when someone owns the review". This is that decision, and the trailing note in the file now records it rather than deferring it.

The template's caution is about a Minecraft plugin compiled against a specific server API, where a bot raising the version is a compatibility change wearing a security change's clothes. Nothing here is that — @resvg/resvg-js and archiver are ordinary runtime dependencies of a build tool, and neither decides what this repository is compatible with. So there is no ignore list, unlike the plugin repositories.

Why the major group is the load-bearing part here

CI carries most of the review. ci.yml runs npm ci, builds the pack at all five resolutions, and runs the animation, palette, base-sync, tiling-rules and sync-studio suites — so a proposal that breaks the toolchain fails before anyone reads it. That is a materially stronger position than TextureStudio, which has no build workflow at all.

What CI does not assert is rendered output. @resvg/resvg-js is a native module, and a major that changes rasterisation would build green, pass every suite, and ship different pixels. Grouping majors separately is what keeps that arriving on its own, to be looked at, instead of riding in with routine patches.

Related Issues

None. Raised by an organisation-wide settings and security audit. The same gap is covered for AntiSpeedrun by Ninja6-MC/AntiSpeedrun#105, for SpiralGenesis by Ninja6-MC/SpiralGenesis#72, and for TextureStudio by Ninja6-MC/TextureStudio#13; brand still needs the npm equivalent.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation / Hygiene update

Checklist

• My code follows the code style of this project.
• I have verified that all unit tests pass locally. — Not run locally; this change touches no source, and Build and Test on this pull request runs npm ci, all five pack builds and all five suites against it, which is the stronger check.
• I have added tests that prove my fix is effective or that my feature works. — Not applicable to a Dependabot manifest. Validated by diffing the parsed key structure against the working blocks in SessionPulse and against TextureStudio's npm block, which it matches exactly; GitHub validates the manifest on push and reports a parse failure on the repository's Dependabot page.
• I have updated documentation / CHANGELOG as appropriate. — The file's trailing note is the documentation here, and it is rewritten to state the decision and what CI does and does not cover.
• My commits follow Conventional Commits.
• Every commit is signed off (git commit -s), per section 5 of CONTRIBUTING.md.