ci(*): accept the deps-dev scope and pin dependabot's commit prefix

[0xKT]

Summary

Two dependency-bump PRs (#385, #387) cannot pass commit lint, and the four
open dependabot PRs do not agree with the twelve already on main about what a
dependency bump is called. This fixes both, on the two sides that own them.

The scope enum lost a scope it was already using. scope-enum became
enforced on 2026-09-05 (8f6ef4c) with a literal deps entry. But
chore(deps-dev) had merged to main on 2026-06-30 (b3959c9, #24), two months
earlier. The enum swept in the sibling and missed this one, so every dependabot
dev-dependency PR fails a gate for using a scope the repo had already accepted.
deps-dev is restored to the enum; it is not a new scope.

Dependabot guesses its own prefix, and it has drifted. Nothing pinned it, so
it infers one from recent history. The 12 bumps merged so far are chore(deps*);
the 4 open ones are build(deps*). That split means git log --grep needs two
prefixes to find dependency work, and it will move again. Every ecosystem now
pins prefix: "build" with include: "scope", which is the documented way to
get build(deps) / build(deps-dev). build is what AGENTS.md section 3.1
defines for external dependencies.

Two npm trees had no entry at all. The repo has five npm lockfiles;
dependabot.yml configured three. /ui-web and /ui-tui/packages/hermes-ink were
missing, and both have produced real dependabot PRs (#385 is a /ui-web PR right
now, #57 was a hermes-ink one). Security updates reach them through the
dependency graph regardless of this file, so they were inheriting none of the
labels, grouping or commit-message settings the other trees get. Adding them is
what makes the prefix fix actually cover every tree rather than three of five.

Neither fix had a gate behind it, so there is one now. Both files are edited
by hand, neither imports the other, and the drift they just had stayed invisible
until a person read a CI log. tests/test_dependabot_scope_canon.py pins six
things: every ecosystem pins its prefix rather than letting dependabot infer one,
the pinned prefixes agree with each other, every scope the config will emit is in
the enum, scopes nobody declared are still rejected, every lockfile tracked in the
tree has an entry, and a repo that has workflows has an ecosystem for them. It reads the enum
by evaluating commitlint.config.cjs with node instead of matching its text,
anchored on a scope that cannot move so a broken extraction fails loudly rather
than satisfying every membership assertion.

What this does not fix: dependabot PR bodies quote upstream release notes
verbatim, which carry emoji and em-dashes, so they still fail the ASCII gate in
scripts/check_pr_body.py. That gate is correct - the PR body becomes the squash
commit body - and the body is rewritten by hand per PR. Only the scope half is
automated here.

Type

• Fix
• Feature
• Docs
• CI / tooling
• Refactor
• Other

Verification

Ran in a clean worktree cut from origin/main:

$ uv run pytest tests/test_dependabot_scope_canon.py \
      tests/test_commit_lint.py tests/test_readme_scope_canon.py -q
19 passed in 2.65s

$ uv run pre-commit run --files .github/dependabot.yml commitlint.config.cjs
check yaml ... Passed   (all hooks Passed or Skipped, none Failed)

$ npx commitlint --from origin/main --to HEAD --config commitlint.config.cjs
(no output, exit 0)

$ PYTHONPATH=. uv run python scripts/check_commit_messages.py origin/main..HEAD
(no output, exit 0)

Each of the four open dependabot subjects, and its prospective squash header,
piped through the real commitlint with this config. Before the change:

FAIL  build(deps-dev): bump the npm-root-security group across 1 directory with 2 updates
PASS  build(deps): bump the tui-security group across 1 directory with 6 updates

After:

PASS  build(deps-dev): bump the npm-root-security group across 1 directory with 2 updates
PASS  build(deps-dev): bump js-yaml from 4.3.1 to 4.3.2 in /ui-web
PASS  build(deps): bump the bridge-security group across 1 directory with 2 updates
PASS  build(deps): bump the tui-security group across 1 directory with 6 updates
PASS  build(deps-dev): bump the npm-root-security group across 1 directory with 2 updates (#387)
PASS  build(deps-dev): bump js-yaml from 4.3.1 to 4.3.2 in /ui-web (#385)
FAIL  build(nonsense-scope): bump something
FAIL  build(deps-devv): bump something
FAIL  build(deps-dev): Bump something with a capital

The last three are the point: the enum still rejects scopes it should reject, so
this widens it by exactly one entry rather than loosening it.

Each assertion in the new test was then checked against a mutant that must fail
it, because a config test that only reads the config it was written against
proves nothing:

KILLED  drop deps-dev from the enum                -> 1 failed, 5 passed
KILLED  let the enum accept a typo scope           -> 1 failed, 5 passed
KILLED  empty the enum entirely                    -> 2 failed, 4 passed
KILLED  drop the /ui-web entry                     -> 1 failed, 5 passed
KILLED  split the ecosystems across two types      -> 1 failed, 5 passed
KILLED  drop the github-actions ecosystem          -> 1 failed, 5 passed
KILLED  let one ecosystem guess its prefix again   -> 1 failed, 5 passed

The dependabot.yml edit was checked structurally, not by eye: both versions
parsed, and every pre-existing entry is identical apart from the added
commit-message block, no entry was dropped, group names stay unique, and the
npm directories now equal the set of npm lockfiles tracked in the repo.

• Relevant tests pass locally
• Relevant lint / type checks pass locally
• User-facing docs or screenshots are updated when needed

Risk

Behaviour changes, all in tooling:

• One more scope is legal. feat(deps-dev): ... also becomes legal, because
  commitlint cannot tie a scope to a type. deps already had that property; this
  does not introduce it.
• Future dependabot commits and PR titles are pinned to build(deps) /
  build(deps-dev) instead of whatever it infers. Existing open PRs already use
  those, so nothing needs rewriting.
• /ui-web and /ui-tui/packages/hermes-ink security updates will now be
  grouped and labelled like the other trees rather than arriving unconfigured.
  open-pull-requests-limit: 0 matches the other entries, so no version-update
  PRs are enabled by this.
• The prefix pin cannot be verified until the next advisory; dependabot's
  behaviour here is documented but not observable from a local run. If it turns
  out wrong, the enum change alone still unblocks the open PRs.

Rollback: revert the commits. Nothing depends on either file at runtime.

• Security impact considered
• Backward compatibility considered
• Rollback path is clear for risky changes

Related Issues

N/A. Unblocks #385 and #387, which fail scope-enum today.

[gloryfromca]

Blocking: move the change to a source branch whose type is allowed by AGENTS.md section 2.1.

The code change itself looks sound. The source branch is ci/dependabot_commit_prefix_scope, but the repository's hard branch-naming rule permits only feat, fix, refactor, perf, chore, docs, and test as branch types. This is not line-anchorable; the exact compliant branch type is the author's choice.

I covered the full github/main...HEAD diff after refreshing github/main, the commitlint callers and Dependabot configuration, relevant history, all five tracked npm lockfile roots, backward compatibility, test-strength changes (none), AGENTS.md/CLAUDE.md and CONTEXT routing, and the runtime/TUI architecture constraints (not implicated). GitHub's documented Dependabot behavior supports the chosen build prefix plus deps/deps-dev scopes, and git merge-tree --write-tree HEAD github/main completed without conflicts.

Local verification:

• uv run pytest tests/test_commit_lint.py tests/test_readme_scope_canon.py -q: 13 passed
• uv run pre-commit run --files .github/dependabot.yml commitlint.config.cjs: passed or skipped, no failures
• Real commitlint accepted build(deps) and build(deps-dev) and rejected an unknown near-match scope
• Repository commit-message checks, YAML/package-root structural checks, PR-body ASCII check, and git diff --check: passed
• GitHub checks were green except the coverage aggregation job was still pending when reviewed

[gloryfromca]

Blocking: the previously reported source-branch policy violation remains unresolved.

No new code findings. The added contract test exercises the loaded commitlint configuration rather than its text, covers both Dependabot scopes plus negative cases, and keeps npm/uv configuration aligned with tracked lockfiles. It does not weaken existing tests.

I rechecked the complete github/main...HEAD diff, the new test and its subprocess/configuration callers, relevant history, backward compatibility, AGENTS.md/CLAUDE.md and CONTEXT routing, and architecture impact (none beyond CI policy). The rebase onto current main is conflict-free.

Verification:

• uv run pytest tests/test_dependabot_scope_canon.py tests/test_commit_lint.py tests/test_readme_scope_canon.py -q: 17 passed
• uv run pre-commit run --files .github/dependabot.yml commitlint.config.cjs tests/test_dependabot_scope_canon.py: passed or skipped, no failures
• Commitlint, repository commit-message checks, and git diff --check: passed
• GitHub's completed checks were green; unit/TUI jobs were still running when reviewed

[gloryfromca]

Blocking: the previously reported source-branch policy violation remains unresolved.

No new findings. The two added assertions close the remaining gaps in the contract test: configured ecosystems must agree on one accepted prefix, and the workflows tree must retain its root github-actions configuration. Existing coverage is not weakened.

I rechecked the complete github/main...HEAD diff, test/config callers and history, backward compatibility, AGENTS.md/CLAUDE.md and CONTEXT routing, and architecture impact. The merge simulation against refreshed github/main is clean.

Verification:

• uv run pytest tests/test_dependabot_scope_canon.py tests/test_commit_lint.py tests/test_readme_scope_canon.py -q: 19 passed
• Focused pre-commit hooks: passed or skipped, no failures
• Commitlint, repository commit-message checks, and git diff --check: passed
• Completed GitHub checks for this revision were green; unit shards were still running when reviewed

[gloryfromca]

No blockers; suggestions only, and they are marked inline.

The code can merge. The new cache is keyed by rule name and returns immutable tuples, so it removes redundant Node subprocesses without coupling the two enums or allowing one test to mutate another's result. Existing coverage is not weakened.

I am withdrawing my prior blocking stance under the required post-fourth-round convergence bar. The branch-name mismatch is introduced here, but it does not cause an ordinary operator failure with no working way out, so it remains only a named, nonblocking follow-up. It cannot be anchored to a changed line. There are no review threads opened by me to resolve.

I covered the complete github/main...HEAD diff, the cache callers and test history, backward compatibility, AGENTS.md/CLAUDE.md and CONTEXT routing, test strength, and architecture impact. The merge simulation against refreshed github/main is clean.

Verification:

• uv run pytest tests/test_dependabot_scope_canon.py tests/test_commit_lint.py tests/test_readme_scope_canon.py -q: 19 passed
• Focused pre-commit hooks: passed or skipped, no failures
• Commitlint, repository commit-message checks, and git diff --check: passed
• Completed GitHub checks were green; unit shards were still running when reviewed