fix: update dependabot configuration for clarity and accuracy in CI workflows

.github/dependabot.yml

@@ -1,12 +1,9 @@
-# Keeps the CI toolchain current. The library itself has no runtime dependencies to bump;
-# requirements-dev.txt only pins the test and validation tooling.
+# Keeps the GitHub Actions used by CI current. Python dependencies are deliberately not
+# tracked: requirements-dev.txt pins minimum versions rather than exact ones, so a floor
+# bump adds nothing and can drop an interpreter the library still supports (pandas 3.x
+# requires Python 3.11+, while this library runs on 3.10).
 version: 2
 updates:
-  - package-ecosystem: "pip"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:

.github/workflows/claude-code-review.yml

@@ -6,10 +6,11 @@ on:
 
 jobs:
   claude-review:
-    # Secrets are not available to pull requests from forks, so the review only runs
-    # for branches in this repository. External PRs are still validated by
-    # validate-skills.yml and reviewed by maintainers.
-    if: github.event.pull_request.head.repo.full_name == github.repository
+    # Secrets are not available to pull requests from forks or to Dependabot-triggered
+    # runs, so the review only runs for human-authored branches in this repository.
+    # External and bot PRs are still validated by validate-skills.yml and reviewed by
+    # maintainers.
+    if: github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]'
     runs-on: ubuntu-latest
     timeout-minutes: 30
     permissions: