ci: fix the changesets/action v2 inputs, give Dependabot a five-day cooldown

[amritk]

What & why

Two CI changes.

The release workflow was broken. The changesets/action 1.9.0 → 2.1.1 bump in #34 renamed every input release.yml passes, and v2 hard-errors on the old names, so the first Release run on the new pin (run 34405857958) stopped before doing anything:

Error: The following inputs have been renamed:
- "publish" -> "publish-script"   - "version" -> "version-script"
- "commit" -> "commit-message"    - "title"   -> "pr-title"

All four are renamed here. The GITHUB_TOKEN environment variable goes with them: v2 reads the token from the github-token input, which already defaults to the job's github.token, and throws when the environment variable is set to anything that does not match it — a second failure waiting behind the first. The NPM_TOKEN comment that lived on that env: block moves up to the step, since its point (nothing in this job may define NPM_TOKEN, or trusted publishing falls back to an .npmrc) is about the job, not about the one variable that happened to be there.

v2 wants @changesets/cli v3, which #35 brought in an hour before the bump.

Dependabot now waits five days. Both ecosystems get cooldown: { default-days: 5 } — the window a bad release usually gets yanked or fixed upstream in. github-actions supports only the flat default-days; bun also has the per-bump semver-*-days variants, unused here. Worth knowing: cooldown holds a version back rather than delaying the run, so on this repo's monthly schedule a release in the five days before a run waits for the next one.

Which packages

Repo tooling — .github/workflows/release.yml and .github/dependabot.yml. No published package is touched.

Exactness

Not applicable: no package's output changes, and no formatter code is touched.

How it was validated

• bun run check, bun run types:check, bun run test — green in CI on this head
• The pinned SHA's action.yml accepts exactly the four input names now passed and nothing else, checked field by field against the schema
• bun changeset status --since=origin/main runs clean on @changesets/cli 3.0.1 locally, so the v3 bump does not break the status check either
• Dependabot's own .github/dependabot.yml check passes on this head, which is what confirms cooldown is accepted on both ecosystems

The one thing CI here cannot prove: release.yml only triggers on pushes to main, so no check on this PR runs the Release job. The real verification is the Release run that fires on the merge commit.

Changeset

• Added a changeset — two empty ones, since neither change touches a published package