[robsable]

What

Adds the repo's first CI workflow and a Dependabot config.

CI (.github/workflows/ci.yml) runs on every PR and on pushes to main:

• cdk: npm ci, tsc --noEmit, jest, and cdk synth of all stacks (cdk-nag checks run during synth). Synth uses a placeholder account ID and makes no AWS calls.
• python: pytest for each Python component that has tests.
• dependabot-auto-merge: squash-merges Dependabot patch and minor PRs, and only after the jobs above pass in the same run. Major updates stay manual.

Dependabot (.github/dependabot.yml):

• /cdk npm: one grouped weekly PR for minor and patch updates, plus one grouped PR for security fixes, replacing one PR per transitive package.
• GitHub Actions: monthly grouped updates for the SHA-pinned actions.

Security notes

• The workflow token is read-only by default. Only the merge job gets contents: write / pull-requests: write, and it runs only on Dependabot PRs.
• The workflow uses pull_request, not pull_request_target, so fork PRs never get a write token or secrets.
• Actions are pinned to commit SHAs, and checkout does not persist credentials.

Verified locally

npm ci, tsc, jest, cdk synth and pytest all pass on main as of this branch. actionlint reports no issues.

Not included

Python requirements.txt files use >= ranges with no lockfile, so Dependabot can't propose pip updates or raise pip alerts for them. Pinning or adding a lockfile is a separate change.