deps(governance): keep breaking majors out of grouped dev-tooling Dependabot PRs

[qnbs]

Context

Current Dependabot configuration groups a broad dev-tooling package set but does not constrain the group by update type.

On current repository state this produced PR #749, which combines:

@playwright/test        1.62.1 → 1.63.0   semver-minor
@vitest/coverage-v8     4.1.11 → 5.0.0    semver-major
vitest                  4.1.11 → 5.0.0    semver-major

The PR's own Dependabot metadata explicitly classifies the Vitest updates as version-update:semver-major and the Playwright update as semver-minor.

PR #749 is not merely stale: live verification of its current head ad8b98a9bf8b975f3ed8b96cfdd4733c5177397b shows CI/CD run #3190 failed. Both Node 22 and Node 24 Quality Gates fail at the Typecheck (tsgo) step, and downstream unit/build/E2E jobs are skipped.

This is exactly the failure mode the dependency-governance contract should prevent: a routine grouped tooling PR becomes a breaking migration bundle with multiple independent causes and poor review/rollback attribution.

Goal

Make automated dependency grouping preserve causal reviewability:

PATCH/MINOR routine compatible updates
        → may be grouped where ecosystem coupling justifies it

MAJOR/BREAKING updates
        → dedicated migration unit / explicit owner / focused evidence

Do not rely on Dependabot generating a broad mixed-major group and then manually disentangling it every time.

Required Dependabot change

Requalify .github/dependabot.yml dev-tooling group and add the smallest supported configuration that prevents semver-major updates from being swept into the routine group.

Conceptually, the routine group should admit only:

minor
patch

using Dependabot's current supported update-types syntax at implementation time.

Do not copy guessed YAML syntax without rechecking current GitHub Dependabot documentation.

Major migration handling

A major must remain discoverable rather than silently ignored forever.

For each excluded major:

• allow Dependabot to produce an independent PR if supported by the final grouping rules; or
• create/retain a dedicated migration owner when architecture/test changes are required.

Vitest 5 already has concrete breaking changes and current typecheck failure evidence, so it should be treated as a dedicated migration, not merged as collateral with a Playwright minor.

Playwright version coherence remains separately owned by #571 because current repository overrides pin playwright and playwright-core to 1.61.0; even a clean runner-only minor PR does not prove an effective browser/core upgrade.

Node/jsdom/undici toolchain truth remains #762.

PR #749 disposition

#749 should not be merged in its current grouped form.

After this policy correction is ready/reconciled:

1. close/supersede build(deps-dev): bump the dev-tooling group across 1 directory with 3 updates #749 rather than repairing the mixed branch into a hand-maintained migration;
2. let routine compatible updates regenerate under the corrected grouping policy;
3. handle Vitest 5 as a bounded dedicated migration with its own compatibility evidence;
4. handle Playwright under toolchain(e2e): reconcile Playwright test/core/browser versions and define deterministic browser-update policy #571's effective-version/browser-revision contract.

Do not use @dependabot recreate before the grouping configuration itself is fixed, or the same mixed shape may simply be regenerated.

Regression / validation

Add a lightweight configuration-level proof where practical that a representative major is not admitted to the routine group while minor/patch updates remain eligible.

At minimum verify from a regenerated Dependabot cycle that:

Vitest 5 major      ≠ bundled into routine dev-tooling group
routine minors      = still grouped as intended
security updates    = not delayed by version-update grouping policy

Security update semantics must remain compatible with the repository's existing security/dependency policy.

Acceptance criteria

• Current Dependabot group semantics are rechecked against official GitHub documentation.
• dev-tooling no longer bundles semver-major migrations with routine minor/patch updates.
• Major upgrades remain independently visible/actionable rather than silently lost.
• build(deps-dev): bump the dev-tooling group across 1 directory with 3 updates #749 is explicitly superseded/closed once corrected grouping is in place.
• Vitest 5 receives a dedicated migration path with the current Node22/24 typecheck failure as starting evidence.
• Playwright alignment remains owned by toolchain(e2e): reconcile Playwright test/core/browser versions and define deterministic browser-update policy #571 and is not falsely declared complete by a manifest-only bump.
• Security updates are not unintentionally suppressed or delayed.
• Regenerated dependency PRs have bounded causal scope and normal exact-head/resulting-main qualification.

Priority

P2 dependency-governance / merge-safety. This is not a production runtime defect, but the current grouping repeatedly creates high-cost mixed migrations and obscures causal failure evidence.