chore: add Dependabot config and drop the inert legacy CI workflow

.github/dependabot.yml

@@ -0,0 +1,60 @@
+# Dependabot configuration for RuneBolt.
+#
+# Scope: only the live tree. `legacy/` holds an archived, non-building snapshot of
+# the Taproot-Assets-era code (full history preserved at tag
+# legacy/taproot-assets-era-final) and is deliberately NOT tracked here — chasing
+# lockfiles for deleted code produced failing "Dependabot Updates" runs.
+#
+# Grouping: minor+patch version updates arrive as ONE PR per ecosystem, majors
+# stay separate (they need a human), and security fixes arrive as ONE PR per
+# ecosystem instead of one PR per package.
+version: 2
+
+updates:
+  # pnpm workspace: the root pnpm-lock.yaml covers packages/* as well, so a
+  # single "/" entry is the whole JS dependency surface.
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "06:00"
+      timezone: "America/Los_Angeles"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+    groups:
+      npm-minor-and-patch:
+        applies-to: version-updates
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+      npm-security:
+        applies-to: security-updates
+        patterns:
+          - "*"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "06:00"
+      timezone: "America/Los_Angeles"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+    groups:
+      actions-minor-and-patch:
+        applies-to: version-updates
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+      actions-security:
+        applies-to: security-updates
+        patterns:
+          - "*"

legacy/README.md

@@ -34,8 +34,14 @@ RuneBolt hub, locked $DOG (`DOG•GO•TO•THE•MOON`, rune id `1:0`) on L1, t
 off-chain against a hub-operated ledger. Backend (Express + SQLite + WebSocket), Next.js frontend,
 `@runebolt/sdk`, Docker/Vault/Grafana infrastructure, and a large body of UX and security research.
 
-`legacy/ci/ci-cd.yml` is the old GitHub Actions workflow, parked here so it no longer runs.
-It is retained; the code it built now lives only under the tag above.
+The old GitHub Actions workflow that built it (`legacy/ci/ci-cd.yml`) has now been removed
+from `main` too. Parking it here already stopped it running, but it kept this directory
+looking like a live build surface and it only ever built deleted code. It is preserved
+unchanged under the tag above (blob `4dc9c28`):
+
+```sh
+git show legacy/taproot-assets-era-final:legacy/ci/ci-cd.yml
+```
 
 ## Why it was superseded