chore(deps): declare the npm ecosystem for Dependabot

[BharathASL]

Description

Dependabot here watched github-actions and nothing else, so @resvg/resvg-js and archiver — the two runtime dependencies this repository actually ships against, both with a committed lockfile — were unwatched. The 0 open Dependabot alerts this repository reports is a consequence of nothing looking, not of a clean tree.

templates/dependabot.template leaves this decision to each repository and asks that it be made "only when someone owns the review". This is that decision, made deliberately, and the trailing note in the file now records it instead of deferring it.

The template's caution is about a Minecraft plugin compiled against a specific server API, where a bot raising the version is a compatibility change wearing a security change's clothes. Nothing in this repository is that. @resvg/resvg-js and archiver are ordinary runtime dependencies of a build tool, and neither decides what this repository is compatible with. So there is no ignore list here, unlike the Gradle repositories.

Majors are grouped separately from minors and patches, and in this repository that matters more than usual — see the honest caveat below.

Two other things this changes:

The header still read # Copy to .github/dependabot.yml, which is an instruction to whoever copies the template and should not have survived into the copy. Keyframe and brand both replaced it with the house wording naming the file as this repository's copy and stating that the path is load-bearing; this now matches them.

The trailing "adding the build's own ecosystem is a separate decision" note is replaced by the decision itself, since leaving a note that defers a decision directly above the decision would be confusing to the next reader.

The caveat worth reading

This repository has no build or test workflow. Its workflows are agent-review-gate, dco, icons, scorecard and standards — none of which builds the pack or runs the tools. So a Dependabot proposal here is verified by reading it and by running npm run build locally, not by CI.

That is the main reason majors are grouped separately: @resvg/resvg-js is a native module, and a major is a rendering change that nothing currently in CI would catch. It is still worth having the proposals — knowing a CVE exists in a dependency is valuable independently of whether a pipeline can prove the fix is safe — but the review burden sits with a person here in a way it does not on the plugin repositories.

Related Issues

None. Raised by an organisation-wide settings and security audit. The same gap is covered for AntiSpeedrun by Ninja6-MC/AntiSpeedrun#105 and for SpiralGenesis by Ninja6-MC/SpiralGenesis#72; Keyframe and brand still need the npm equivalent.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation / Hygiene update

Checklist

• My code follows the code style of this project.
• I have verified that all unit tests pass locally. — There are none to run; this repository has no test suite and no test workflow, which the caveat above covers.
• I have added tests that prove my fix is effective or that my feature works. — Not applicable to a Dependabot manifest. Validated instead by diffing the parsed key structure against the working ecosystem blocks in SessionPulse; GitHub validates the manifest on push and reports a parse failure on the repository's Dependabot page.
• I have updated documentation / CHANGELOG as appropriate. — The file's own header and trailing note are the documentation here, and both are rewritten to match what the file now does.
• My commits follow Conventional Commits.
• Every commit is signed off (git commit -s), per section 5 of CONTRIBUTING.md.