Group Dependabot updates and guard against missing changesets

[ocean90]

Follow-up to the Dependabot/changeset discussion. Instead of the auto-changeset writer (which would be dormant in this repo — the published packages have no runtime dependencies, so Dependabot only bumps root dev tooling + composer, and the real changesets we needed were human judgment calls), this adds the two things that actually help.

(a) Dependabot grouping — less PR noise

• npm: group the interrelated lint toolchain (@wordpress/*, eslint*, stylelint*, prettier, typescript) into one weekly PR instead of one per package (the Update wp-coding-standards/wpcs requirement from 3.3.0 to 3.4.0 #263–Bump @wordpress/stylelint-config from 23.42.0 to 24.0.0 #266 wave would have been ~1 PR).
• github-actions: batch all action bumps into one PR.
• composer: left ungrouped on purpose — the PHP stack is exact-pinned and each bump is a deliberate review against the PHP_CodeSniffer 3 ceiling (WPCS/slevomat), so mixing them would hide risk.

(b) Changeset guard — catch the real cases

A new changeset-guard CI job fails a PR when a published package's package.json changes but no newly added changeset is present — exactly the peer/dependency class we fixed by hand in the v7 alphas (globals removal #267, @wordpress/stylelint-config ^24 #266). It forces the right changeset rather than guessing one.

• Scoped to packages/*/package.json → stays quiet for root dev-tooling bumps, composer, and docs.
• Requires an added (A) .changeset/*.md — an edited existing changeset doesn't count, since editing one doesn't version a new change (and in pre mode doesn't trigger a release).
• Skips push events and the changesets Version Packages PR (which intentionally removes changesets).

Verified locally against these diff scenarios (the package.json below is always a published packages/*/package.json):

Diff	Result
manifest changed, no changeset	fail
manifest changed + newly added changeset	pass
manifest changed + only an edited existing changeset	fail
manifest changed + only .changeset/README.md	fail
root devDependency bump only (no packages/*/package.json)	pass
docs-only change	pass

To enforce it, add Changeset guard to the branch-protection required checks for master.

[Copilot]

Pull request overview

This PR reduces automated dependency-update noise by grouping Dependabot PRs, and adds a CI “changeset guard” to enforce that consumer-facing package manifest changes in packages/*/package.json are accompanied by a Changesets entry.

Changes:

• Add a new CI job that fails PRs when packages/*/package.json changes without a corresponding changeset.
• Group related npm lint-toolchain updates into a single weekly Dependabot PR.
• Group all GitHub Actions updates into a single weekly Dependabot PR.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/ci.yml	Adds the changeset-guard job to enforce manifest-change → changeset coupling on PRs.
.github/dependabot.yml	Introduces Dependabot grouping for npm lint tooling and GitHub Actions updates to reduce PR volume.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[ocean90]

Thanks @copilot — both addressed in bc47ede:

1. Only count added changesets (ci.yml:69): switched from git diff --name-only to --name-status and require an added (A) .changeset/*.md. A merely edited existing changeset no longer satisfies the guard — which is also correct for this repo, since editing a changeset (especially a consumed one in pre mode) does not version a new change.
2. Description ambiguity (ci.yml:71): reworded the verified-scenarios section. The .changeset/README.md case was always paired with a manifest change (README is not a real changeset); a README-only change with no manifest change passes, as intended. The table now states the manifest precondition explicitly.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.