feat(foundation)!: 🧱 require Dependabot and Copilot instructions universally

[szmyty]

Make these repository-owned files required by the universal foundation:

• .github/dependabot.yml
• .github/copilot-instructions.md

A repository selecting only universal now receives an exact missing-file diagnostic for either file. Other hardened-profile artifacts, AGENTS.md, and generated ecosystem context retain their current profile applicability; broader agent-entry-point reconciliation is tracked in egohygiene/hygiene#64.

The foundation catalog advances to 2.0.0 because existing universal consumers may need to add these files before upgrading. The JSON authoring schema remains 1.1.0; the resolver distinguishes baseline and schema versions. Generated inventory, ignore-plan fingerprints, and the EgoLint projection are reconciled. Existing consumers retain pinned inputs/resolvers until a reviewed upgrade.

The actual Dependabot settings and Copilot instructions remain repository-owned and unchanged. Presence checks do not establish provider activation, instruction adherence, complete dependency coverage, or successful updates.

Parent: egohygiene/.github#32
Refs #62.

Validation

• 32 foundation contract/composition/Git-behavior tests passed on the updated tree. The universal-only fixture checks both missing files independently and preserves the other profile boundaries.
• Ruff 0.16.5 check/format, Mypy 1.19.1, Bandit 1.9.4 using canonical repository configurations, and whitespace checks passed.
• Catalog and manifest JSON Schema validation passed for the baseline upgrade; this addition retains the same schema shape.
• Earlier broader root-suite run: 186 tests, one unrelated existing failure, 17 skips. test_commitlint_uses_the_locked_local_node_toolchain expects an older actions/setup-node pin; its test and workflow are unchanged from base 480d70bc59c989f46abf7a323e645699b11c7d4a. That unrelated suite was not rerun for this focused addition.
• Source catalog bytes were read back at d597e6fac0b5e8205e4878eaf133101af3487e98; the generated EgoLint projection pins that actual source commit. Final published tree matches the locally checked index.

Pending readiness gate

Draft pending the repository-required manual MegaLinter holistic run on the frozen review branch at exact head 2978b6cd3e8aeb8c1b4d03e3a478e1facf3506c3. The connector cannot dispatch workflows and this environment has no container runtime. The fast PR profile does not substitute for that run. Review gating findings and warning-only Mypy/Bandit/Secretlint/Lychee diagnostics before marking ready.

Retain the source commits when merging so the generated projection's immutable provenance remains in repository history. Release publication and fleet adoption remain separate work.