chore: fix Dependabot version-bump gate and stop tightening squawk-cli

.github/dependabot.yml

@@ -22,6 +22,9 @@ updates:
     ignore:
       - dependency-name: "*"
         update-types: ["version-update:semver-major"]
+      # squawk-cli's >=2.0 floor is intentionally broad so consumers can pin any
+      # squawk 2.x via additional_dependencies. Do not let Dependabot tighten it.
+      - dependency-name: "squawk-cli"
 
   # GitHub Actions
   - package-ecosystem: "github-actions"

.github/workflows/ci.yml

@@ -64,7 +64,10 @@ jobs:
           fi
           echo "Versions match: $PYPROJECT_VERSION"
 
-          if [ "${{ github.event_name }}" = "pull_request" ]; then
+          # Dependabot never bumps the package version, only dependencies, so
+          # exempt it from the version-bump requirement or its dependency PRs
+          # (which edit pyproject.toml) would always fail this check.
+          if [ "${{ github.event_name }}" = "pull_request" ] && [ "${{ github.actor }}" != "dependabot[bot]" ]; then
             git fetch origin main --depth=1
             MAIN_VERSION=$(git show origin/main:pyproject.toml | python -c "import sys, tomllib; print(tomllib.loads(sys.stdin.read())['tool']['poetry']['version'])" || true)
             if [ -z "$MAIN_VERSION" ]; then