Dependabot proposed nvidia/cuda 12.6.3 to 12.9.2 (#441), a minor bump the existing semver-major ignore did not catch. The 12.6 base is deliberate: the AI bundle wheels are cu126, libcublas-12-6 matches, and a 12.9 base requires driver R575+ so the container fails to start on common 570.x production drivers (the regression PR #334 fixed). Ignore nvidia/cuda >= 12.7 so 12.6.x patch bumps still flow while 12.7+ is held back.
Dependabot was creating orphaned branches for risky major bumps
(Node 22->25, CUDA 12->13, Pillow 11->12, onnxruntime 1.20->1.25)
without opening PRs. These require manual evaluation, not auto-update.
Aligns pip and docker config with the npm ecosystem which already
ignores major bumps.
Add .vscode/ with Biome formatter, Tailwind, Vitest, Playwright, and
Python debug configs. Extract shared pnpm/Node setup into a composite
GitHub Action and add Dependabot and dependency-review workflows.
