ci: add dependabot, conventional commits check, and scheduled weekly tests

- dependabot.yml: weekly auto-PRs for pip and github-actions deps
  (major version bumps ignored, reviewed manually)
- conventional-commits.yml: blocks PRs with non-conforming titles;
  warns on individual commits (required for release-please changelogs)
- scheduled-tests.yml: weekly pytest run on py3.10+3.11, plus
  dependency vulnerability audit via safety

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/dependabot.yml

@@ -0,0 +1,26 @@
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "06:00"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+    ignore:
+      # Ignore major version bumps — review manually
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "06:00"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "github-actions"

.github/workflows/conventional-commits.yml

@@ -0,0 +1,78 @@
+name: Conventional Commits
+
+on:
+  pull_request:
+    branches: [master, main]
+    types: [opened, edited, synchronize, reopened]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  check-title:
+    name: Validate PR Title
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check PR title follows Conventional Commits
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+        run: |
+          echo "PR title: $PR_TITLE"
+
+          # Conventional Commits pattern: type(scope)!: description
+          # Types: feat, fix, docs, style, refactor, perf, test, build, ci, chore, revert
+          PATTERN='^(feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert)(\([^)]+\))?(!)?: .{1,100}$'
+
+          if echo "$PR_TITLE" | grep -qE "$PATTERN"; then
+            echo "✓ PR title follows Conventional Commits format"
+          else
+            echo "::error::PR title does not follow Conventional Commits format."
+            echo ""
+            echo "Expected format:  type(scope): description"
+            echo "Examples:"
+            echo "  feat: add volatility factor"
+            echo "  fix(optuna): fix inverted range in stage 2"
+            echo "  ci: add dependabot config"
+            echo "  chore(deps): pin aiohttp>=3.13.4"
+            echo ""
+            echo "Valid types: feat, fix, docs, style, refactor, perf, test, build, ci, chore, revert"
+            echo ""
+            echo "This is required for release-please to generate correct changelogs."
+            exit 1
+          fi
+
+  check-commits:
+    name: Validate Commit Messages
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Check commits in PR follow Conventional Commits
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          PATTERN='^(feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert)(\([^)]+\))?(!)?: .+'
+
+          FAILED=0
+          while IFS= read -r msg; do
+            # Skip merge commits
+            if echo "$msg" | grep -qE "^Merge (pull request|branch|remote)"; then
+              continue
+            fi
+            if ! echo "$msg" | grep -qE "$PATTERN"; then
+              echo "::warning::Non-conventional commit: $msg"
+              FAILED=1
+            fi
+          done < <(git log "$BASE_SHA..$HEAD_SHA" --format="%s")
+
+          if [ $FAILED -eq 1 ]; then
+            echo ""
+            echo "::warning::Some commits don't follow Conventional Commits."
+            echo "This won't block the PR but may affect changelog generation."
+          else
+            echo "✓ All commits follow Conventional Commits format"
+          fi

.github/workflows/scheduled-tests.yml

@@ -0,0 +1,68 @@
+name: Scheduled Tests
+
+on:
+  schedule:
+    # Every Monday at 07:00 UTC
+    - cron: "0 7 * * 1"
+  workflow_dispatch:  # Allow manual trigger
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Weekly Test Run (Python ${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11"]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: "pip"
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[test]" || pip install -r requirements.txt
+          pip install pytest pytest-cov
+
+      - name: Run tests
+        run: |
+          pytest test/backtesting/ -v --tb=short --durations=10
+
+      - name: Upload results on failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: test-results-py${{ matrix.python-version }}
+          path: |
+            .pytest_cache/
+          retention-days: 7
+
+  dependency-audit:
+    name: Dependency Audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.10"
+          cache: "pip"
+
+      - name: Install safety
+        run: pip install safety
+
+      - name: Check for known vulnerabilities
+        run: |
+          echo "=== Weekly dependency vulnerability scan ==="
+          safety check -r requirements.txt --json || {
+            echo "::warning::Vulnerabilities found — review and update dependencies"
+            exit 0
+          }