chore(deps): track Docker base images in dependabot

[pofallon]

Salvages the one useful part of #39 and deliberately drops the rest. Closes #39.

What this adds

Both Dockerfiles were unwatched:

path	base images
/Dockerfile	python:3.13-slim
/docker/Dockerfile	node:20-slim, python:3.11-slim

A base image could sit on an unpatched tag indefinitely. Base images are where container CVEs usually arrive, and an untracked one fails invisibly — it simply never produces a PR.

What this does NOT take from #39, and why

1. Its cooldown additions are already on main. #70 added default-days: 7 to both the pip and github-actions entries on 2026-07-22. That half of #39 is redundant.

2. Its [tool.uv] exclude-newer = "7 days" would reopen a security advisory.

Not theoretical — I applied it and resolved:

cryptography: 50.0.0  ->  49.0.0

cryptography 50.0.0 was published 5 days ago, inside the 7-day window. 49.0.0 sits inside the vulnerable range of the >=44.0.0, <50.0.0 advisory — the one cleared yesterday in #145. It also invalidates the lockfile outright (uv lock --check fails).

The PR body says "Security updates are never delayed". That is true of Dependabot, which exempts security updates from cooldown. It is not true of uv's exclude-newer, which is a blunt resolution-time filter with no security carve-out. For a repo with a committed lockfile, resolution only happens when someone deliberately runs uv lock — which Dependabot already gates. The cooldown belongs at the proposal layer, where it already is; adding it at the resolver buys nothing and costs security latency.

3. Its docker directories were wrong. / and /notifier — but /notifier exists only on an unmerged feature branch. That entry would have looked like Docker coverage while providing none, and nothing would have said so.

Also worth noting for whoever revisits #39: its diff is 73 files, because the branch is stale (June 15) and carries the entire unmerged notifier feature — that work is #45/#47. Merging #39 would pull all of it in.

Guard

tests/unit/test_dependabot_config.py checks both directions:

• every configured directory exists — what chore: enforce 7-day supply-chain cooldown on dependencies #39 got wrong
• every Dockerfile on disk is covered by some entry — so a new or moved image cannot silently go unwatched
• the cooldown is not half-applied across ecosystems

Mutation-verified: #39's exact /notifier path fails 3 checks; dropping /docker fails the coverage check; removing a cooldown fails the third. 2135 tests pass.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NiM3TyqKUySZr9en9quq5c