dependabot: group uv dev tooling and runtime patch/minor bumps

[potiuk]

Code change

Summary

Grouping was already in place for github/codeql-action*, but the uv ecosystem had none - so five separate PRs landed today (#1208-#1212) for ruff, mypy and types-pyyaml across /pelican and /stash. All five are PEP 735 dev group tooling that never ships in the published action, so one PR per tool buys no review value.

• dev-tooling group (dependency-type: development, patterns: ["*"]) - collects the lint/test tooling. Dependabot opens one PR per directory per group, so today's five become two.
• runtime-minor-patch group (dependency-type: production, minor + patch only) - keeps routine runtime bumps together.
• Major bumps of runtime dependencies match no group and so keep their own PR. A major version of something the action ships can break consumers and deserves to be reviewed and released alone.
• The allow-list ecosystem stays ungrouped, and now carries a comment saying why: every bump there gets its own security review and its own verify run, so grouping would tie an action that fails verification to unrelated ones that passed.
• README documents the grouping table and both deliberate exclusions.

Dependabot classifies these correctly today - #1155 (markdown) reports dependency-type: direct:production and #1190 (ruff) reports direct:development - so both groups match what is already being emitted.

Type of change

• Workflow or CI change
• Documentation update

Testing

• .github/dependabot.yml parses and resolves to the three expected ecosystems with the intended group keys.
• prek run --all-files clean.
• No code paths touched; the effect is visible on Dependabot's next weekly uv run.

---

Drafted-by: Claude Code (Opus 5); reviewed by @potiuk before posting