[woksin]

Added

• A manually dispatched workflow that distributes a standard Dependabot configuration (GitHub Actions only, one grouped update, monthly) to the organization's repositories, merging into an existing dependabot.yml without overwriting it. It defaults to a read-only dry run that lists the exact repositories and files it would change. (Bump per-repository action pins off Node 20 (checkout, setup-node, setup-dotnet, artifacts, docker) #235)

[woksin]

Notes for reviewers.

• Review (separate reviewer, security lens included): no blocking findings. Minor advisories left: a commented-out github-actions entry counts as present (safe: the repo is skipped), the YAML re-parse is skipped when PyYAML is missing, private repos not on the exclude list are included, and an empty repository counts as a failure.
• Local gate: the five bootstrap test suites (54 tests), bash -n and actionlint on both new workflows passed. The zizmor lint could not run locally (installer is Linux-only); CI covers it.
• Dry run (read-only) listed 43 repositories; the list is on Bump per-repository action pins off Node 20 (checkout, setup-node, setup-dotnet, artifacts, docker) #235. After merge, the rollout is started by manual dispatch with dry_run false. Merging this PR itself triggers no write; the bootstrap files and the package-update safety test are untouched.
• Waiting for Refuse plaintext Pulumi reads in the guarded action #236 to merge, then merge main and re-check before merging this.