chore(ci): slow both dependabot channels from weekly to monthly

[os-sam]

Maintainer-directed change (direct-dispatch channel; the dispatching PM session is session_015adLit3ZYASJiXwxKG78Wi). Sibling of objectstack-ai/objectui#7039 — same ruling, this repo's copy.

Authorization, quoted verbatim

2026-08-31, PM chat channel: first 「interval: weekly → monthly」 (ruled for objectui), then:

objectstack 也改为按月

The change

.github/dependabot.yml — both update blocks (package-ecosystem: "npm" and package-ecosystem: "github-actions"):

• schedule.interval: "weekly" → "monthly"
• Remove the day: "monday" line in each block — schedule.day is only meaningful for weekly per the dependabot config schema; verify against the current schema docs rather than taking it from this card, and report instead of guessing if that reading is wrong.
• Keep time: "02:00" (valid for any interval) and everything else — groups, open-pull-requests-limit, commit-message config — untouched.

Context

Cadence-only change: dependency-update PR volume drops ~4×; GitHub security-alert PRs are not driven by schedule and stay immediate. Any auto-merge machinery stays as is.

Acceptance

• YAML parses after the edit (quote the command).
• The repo's changeset gate consulted, not assumed (.github/ is not released-package source; expect none owed).
• Diff touches only the two interval values and the two day lines.

[os-sam]

Claim: maintainer direct-dispatch (director seat session)
Session: session_015adLit3ZYASJiXwxKG78Wi
Branch: claude/issue-13850-dependabot-monthly
Worktree: objectstack-issue-13850
Domain: none yet — direct-dispatch card; triage backfills the lane label
File surface: .github/dependabot.yml (stop on breach; explain in the report)
Container & model: S mechanical, mode:subagent, model: sonnet (tier reading from this hour's dispatch-gates.mjs --tier .github/dependabot.yml run: "no path-derived mandate … floor sonnet"; clause-② not reachable from content — update cadence only, no contract accept/reject change)
Clause-②: no
Serial constraints cleared: none — read the full open-PR list this hour; no open PR or live claim touches .github/dependabot.yml (the two open dependabot PRs #13589/#13579 touch manifests/lockfile, not this config)

---

Generated by Claude Code

[os-sam]

Dev-agent claim (separate from the PM's dispatch-claim comment above).

Session: session_015adLit3ZYASJiXwxKG78Wi
Branch: claude/issue-13850-dependabot-monthly
Worktree: ../objectstack-issue-13850
PR: #13853 (draft)

Starting implementation now.

---

Generated by Claude Code

[os-sam]

os-dev-report
{
"issue": 13850,
"status": "done",
"branch": "claude/issue-13850-dependabot-monthly",
"pr": "#13853",
"premise_still_valid": true,
"summary": "Both dependabot.yml update blocks (npm, github-actions) moved schedule.interval from weekly to monthly and dropped the schedule.day: monday line in each (day is only meaningful for a weekly interval per the dependabot config docs, verified via web search since docs.github.com is egress-blocked from this container). schedule.time: 02:00 and all other keys (groups, open-pull-requests-limit, commit-message) left untouched. Diff is exactly the two interval edits and two day-line removals.",
"tests": "YAML parse: python3 -c \"import yaml; yaml.safe_load(open('.github/dependabot.yml'))\" -> PARSE OK, both blocks show {'interval': 'monthly', 'time': '02:00'}. Changeset-presence gate replicated locally per pr-automation.yml's changeset-check job: ADDED=$(git diff --name-only --diff-filter=A $(git merge-base origin/main HEAD) HEAD -- '.changeset/*.md' | wc -l) -> "This PR adds 0 changeset(s)" (diffed from f532630) -- config-only change, no changeset owed. skip-changeset label applied via additive POST /repos//issues/13853/labels (HTTP 200) and confirmed via read-back GET (HTTP 200, label present).",
"mcp_calls": 6,
"open_questions": [],
"out_of_scope_findings": []
}

---

Generated by Claude Code

[os-sam]

ACCEPT — PR #13853, reviewed against the diff at head bd12a33.

• Diff is exactly the ruled scope: the two schedule.interval values weekly → monthly, the two day: "monday" removals, time: "02:00" kept in both blocks; groups/limits/commit-message untouched.
• GitHub's own dependabot config validation check run (.github/dependabot.yml, posted by dependabot-api) is green on this head — the strongest possible parse verdict, on top of the dev's local PyYAML reading.
• Changeset verdict replicated from the repo's own changeset-check job logic: 0 owed for a config-only diff; skip-changeset applied with read-back confirmation.
• Landing: waiting only on CI convergence (type-check/lint jobs in_progress at review time — honest reading, not a red). This seat flips ready and enqueues once every check on the head is green, then follows to MERGED.

---

Generated by Claude Code