fix(deps): consolidate dependabot uv ecosystem to single workspace root

[jsonmp-k8]

Summary

• replace the per-member directories: list under package-ecosystem: uv with a single /python entry so Dependabot uses the root [tool.uv.workspace] to discover members and refreshes python/uv.lock in the same PR
• group OpenTelemetry and Google AI Python dependencies so lockstep families land in a single PR
• add applies-to: version-updates to the Python groups so security updates remain ungrouped
• ignore semver-major /ui npm bumps so known-breaking major frontend upgrades stop opening standalone PRs

Why

Currently Dependabot opens separate PRs for each workspace member's pyproject.toml without refreshing the root python/uv.lock. Those PRs then fail CI when Docker runs uv sync --locked.

In a uv workspace the lockfile lives only at the workspace root; members have only a pyproject.toml. Dependabot's native uv ecosystem already discovers workspace members through the root [tool.uv.workspace] section, so a single directory: /python entry covers every member and updates the root lockfile alongside any member manifest in the same PR — no separate workflow or write-back step needed.

This replaces #1756, which did the same job via a pull_request_target workflow that ran uv lock and pushed back to Dependabot's branch. The reviewer flagged that handoff as undesirable; this approach removes it entirely while keeping the orthogonal grouping and ignore improvements that PR introduced.

Verification

• ruby -e 'require "yaml"; YAML.load_file(".github/dependabot.yml")' (parses cleanly)
• Once merged, the next Dependabot run on a Monday should produce at most one Python PR per group with both python/pyproject.toml (or a member's) and python/uv.lock updated together.

cc @EItanya

[Copilot]

Pull request overview

This PR updates the repo’s Dependabot configuration to better align with how uv workspaces manage lockfiles, ensuring Dependabot refreshes python/uv.lock alongside member pyproject.toml updates, while also improving dependency grouping/ignores.

Changes:

• Switch uv Dependabot config to a single workspace-root directory: /python so workspace-member updates also update the root python/uv.lock.
• Add Dependabot groups for OpenTelemetry and Google AI Python dependencies, and scope Python grouping to version updates only (applies-to: version-updates).
• Ignore semver-major npm updates for /ui to suppress known-breaking major frontend upgrade PRs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.