chore: add seven-day Dependabot cooldown

[simongdavies]

Summary

• Add cooldown.default-days: 7 for GitHub Actions, Cargo, and npm.
• Keep the existing daily 03:00 schedule, PR limits, and ignored dependency unchanged.
• Delay version-update PRs until releases are at least seven days old; security updates remain unaffected.

Validation

• git diff --check passed.
• Commit created with git commit -S -s; GPG signature verified and Signed-off-by trailer present.
• just check was started but stopped during native runtime compilation after several minutes. The full quality gate did not complete; this change only modifies Dependabot configuration.

[Copilot]

🟡 Changes recommended

The PR description’s “release age” expectation may not match Dependabot’s GitHub Actions cooldown behavior, so the configuration should be clarified to avoid misleading operational expectations.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR updates HyperAgent’s Dependabot configuration to introduce a seven-day cooldown before Dependabot opens version update PRs, aiming to reduce update churn and avoid immediately adopting freshly published dependency versions.

Changes:

• Added cooldown.default-days: 7 to the GitHub Actions update config.
• Added cooldown.default-days: 7 to the Cargo update config.
• Added cooldown.default-days: 7 to the npm update config.

File summaries

File	Description
.github/dependabot.yml	Adds a 7-day Dependabot cooldown across configured ecosystems while keeping the existing schedule/limits/ignore rules.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.