Add Dependabot for pyproject and package-lock

[askmy-stack]

Background

Identified during OSS audit v2 of cortex.

Problem Statement

No dependency bot.

Proposed Solution

dependabot.yml.

Acceptance Criteria

• Implementation complete
• Tests pass
• Documented in README or docs/

Files / Modules Affected

.github/dependabot.yml

---

Suggested labels: priority:medium, good first issue, category:security
Milestone: v1.0-oss-ready
OSS Audit: Master Backlog v2