What changed

• enable weekly Dependabot updates for pip and GitHub Actions
• limit each ecosystem to five open PRs and exclude semver-major updates
• automatically rebase-merge eligible Dependabot PRs only after the matching CI commit succeeds
• automatically remove Pigbibi review requests from Dependabot-authored PRs, including later manual re-requests

Why

QmtPlatform was the only active organization repository without Dependabot enabled. This aligns it with the existing organization policy while keeping major upgrades manual. No CODEOWNERS rule is added, so repository review governance is unchanged.

Validation

• bash syntax checks for embedded workflow scripts
• git diff --check
• byte-for-byte comparison with the deployed UsEquityStrategies standard workflows