fix(dependabot): validate exclusions and restore update jobs

[ty-everett]

Program and scope

GitHub rejected the parent-relative exclude-paths added in #562 and disabled all Dependabot update jobs. Replace them with recursive filename globs that match the same ancestor pnpm support files at both infrastructure directory depths. Add an early, dependency-free regression check for GitHub's forbidden .. patterns. Advances #402.

Impact

• No public package source or manifest changed
• Documentation or examples changed

Root pnpm scanning and all eight infrastructure npm manifests/lockfiles remain monitored. Monthly grouping, immediate security updates, first-party release ownership, and workflow permissions are unchanged. No package version change is needed.

Verification

• Self-reviewed the complete diff and the upstream Dependabot fetcher/filter logic.
• Local pnpm health:check, pnpm lint, pnpm format:check, pnpm build, and post-build pnpm typecheck passed. A fresh checkout requires its built declarations before typechecking documentation consumers.
• Regression rejects both two- and three-level parent patterns; accepts recursive globs and ignores unrelated configuration values.
• Ruby's upstream File.fnmatch? flags match all four ancestor support-file paths, without matching package.json or package-lock.json.
• Exact-head hosted checks terminal and successful; verify actual Dependabot configuration and update jobs after merge.

Security and dependencies

• No dependency or lockfile change, override, dismissal, suppression, or skipped test.
• Workflow permissions and lifecycle-script behavior remain least privilege.
• Exact-head CodeQL has no new alert; repository Sonar gate has zero new findings.

Dependency evidence

• Release notes and necessity: GitHub's live configuration error rejects ..; the existing updater workaround must use accepted syntax.
• Runtime, build, and peer compatibility: automation-only; public/runtime contracts unchanged.
• Deduplicated lockfile: unchanged.
• Audit and CodeQL: no dependency graph change; hosted static checks pending.
• Package and consumer tests: workspace build/typecheck and complete local health controls passed.
• Bundle and performance impact: none.
• Affected public package versions: none.

Release and operations

• No npm publication performed; no image or database change.
• Documentation describes the syntax constraint and updater boundary.
• Completion requires actual GitHub update-job validation; this PR is draft while hosted checks run.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[ty-everett]

Maintainer critical review of exact head 76e53be: replaces only the schema-invalid ancestor exclusions with recursive filename globs, preserving root and standalone npm coverage. The dependency-free guard is linear string parsing after correcting the new Sonar performance finding. Regression evidence and all required local checks passed, followed by successful exact-head CI, Conformance, CodeQL and zero-new-Sonar checks. No open CodeQL merge-ref alert or review thread remains. Approved for maintainer integration; the live Dependabot configuration and update jobs will be verified immediately after merge. No dependency versions, credentials, permissions or quality thresholds change.