Dependency bumps cannot pass the gate under their own name

[iderex]

The pull-request gate refuses any commit whose message names no issue, and Dependabot's message format is fixed - so its four open bumps (#174, #175, #176, #177) red on commit-message-names-no-issue by construction. The three codeql-action bumps additionally red each other: init, analyze and upload-sarif move separately while the CodeQL workflow needs them in step, which is why #175 and #176 also fail the CodeQL job itself.

I am landing the same content under this issue: one commit bumping the three codeql-action pins to 4.37.7 together, and one commit bumping setup-uv to 10.0.1, both carrying exactly the pins Dependabot resolved. The four Dependabot pull requests close as superseded once their replacements are green.

What this issue does not settle: whether Dependabot on this repository should keep opening pull requests the gate refuses by construction. Exempt the bot from the rule, adopt its branches routinely the way this issue does once, or drop the bot - that is a policy choice, and it stays open here until it is decided.

[iderex]

Decided 26 Aug: routine adoption is the line. Dependabot stays as the reporter; due bumps are adopted in bundles under a carrying issue with the pins it resolved, the way #191 and #192 did it once. The gate rule stays untouched - a commit on this repository names its issue, bot or not. The bumps landed and the line is recorded, so this closes.