Stop routine updates from starving the engine bump

.github/dependabot.yml

@@ -1,15 +1,39 @@
 # Keep dependencies current, most importantly the @infino-ai/infino engine —
 # a new engine release should show up here as a PR that has to pass CI, not
 # as silent drift.
+#
+# Dependabot has no priority setting, and a full queue means it simply opens no
+# more PRs — so the dependency that matters most here can be the one left out
+# (it has happened: a full queue of routine updates starved an engine release).
+# The fix is to keep the queue from filling: every dependency except the engine
+# rides in one grouped PR, occupying a single slot however many are pending,
+# while @infino-ai/infino matches no group and so always gets its own.
 version: 2
 updates:
   - package-ecosystem: npm
     directory: /
     schedule:
       interval: daily
+    # Move the declared range, not just the lockfile. The default only edits
+    # package.json when the new version falls outside the range, so an engine
+    # patch inside `^0.5.x` updated the lockfile alone: CI then tested the new
+    # version while the published package still accepted any 0.5.x, including
+    # patches nothing verifies any more. `increase` raises the floor to the
+    # version actually tested.
+    versioning-strategy: increase
     open-pull-requests-limit: 5
+    groups:
+      dependencies:
+        patterns:
+          - "*"
+        exclude-patterns:
+          - "@infino-ai/infino"
 
   - package-ecosystem: github-actions
     directory: /
     schedule:
       interval: weekly
+    groups:
+      actions:
+        patterns:
+          - "*"

src/mcp/server.ts

@@ -301,7 +301,7 @@ export async function serveMcp(rootPath?: string): Promise<void> {
           .string()
           .describe("A single read-only SELECT or WITH statement. May use search table functions and {{name}} vector placeholders."),
         embed: z
-          .record(z.string())
+          .record(z.string(), z.string())
           .optional()
           .describe('Map of placeholder name → query text, embedded server-side. E.g. {"q":"vector indexing"} fills {{q}}.'),
         path: z