chore: validate Dependabot commits instead of skipping them - #22

Re-review. Prior findings ledger: (1) exemption removed without CI running a commitlint that exempts URL lines — fixed in an earlier push (33ab896), verified again here: .github/workflows/ci.yaml pins yo61/commitlint-github-action@501ff7b… (v6.3.0, digest-pinned), which carries @commitlint/ensure ^21.2.0. (2) prefix pin covered only the pre-commit ecosystem, leaving uv and github-actions on auto-detection — fixed by this commit: both blocks now carry commit-message: {prefix: chore, include: scope}, matching the pre-commit block and this repo's own historical Dependabot subject style (chore(deps): bump …). All three Dependabot ecosystems now produce a pinned, commitlint-conformant subject, and the exemption removal in commitlint.config.mjs no longer relies on auto-detection anywhere. No new findings.