[NOT-745] ci: add a cooldown to Dependabot version updates

[giordano-lucas]

Dependabot currently proposes a new release as soon as it is published, which is the window in which a compromised or yanked version is still undetected.

This adds a cooldown to both the gomod and github-actions update configs, so a release has to age before an update is opened:

• 3 days for patches
• 7 days for minors
• 14 days for majors

Security updates are exempt from cooldown, so advisories and CVE fixes are not delayed by this.

Linear: NOT-745 — https://linear.app/nottelabsinc/issue/NOT-745/notte-cli-pr-56-ci-add-a-cooldown-to-dependabot-version-updates

[greptile-apps]

Greptile Summary

This PR adds release-age cooldowns to the Go module and GitHub Actions Dependabot configurations while documenting that security updates remain exempt.

• Delays patch updates for 3 days, minor updates for 7 days, and major updates for 14 days.
• Applies a 7-day default cooldown to versions not covered by the semantic-version categories.
• Adds no automated validation for the new configuration.

Confidence Score: 4/5

The PR appears safe to merge, with the non-blocking concern that the new Dependabot configuration has no automated validation coverage.

The cooldown settings are consistently applied to both package ecosystems, and the only accepted concern is that malformed or ineffective future configuration could go undetected without a validation test.

Files Needing Attention: .github/dependabot.yml

Important Files Changed

Filename	Overview
.github/dependabot.yml	Adds matching cooldown policies for both configured ecosystems; the configuration change is clear but lacks automated validation coverage.

Prompt To Fix All With AI

### Issue 1
.github/dependabot.yml:11-15
**Cooldown configuration lacks validation**

The new cooldown blocks are not covered by an automated configuration validation test, so an invalid key, value, or indentation change can remain undetected until Dependabot processes the file and fails to apply the intended aging policy.
- Add a comment if the PR does n... ([source](https://app.greptile.com/review/custom-context?memory=instruction-0))

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "ci: add a cooldown to Dependabot version..." | Re-trigger Greptile}