Standardize CI and Dependabot baseline

[bernalde]

Summary

• Add weekly Julia Dependabot coverage for benchmark/Project.toml.
• Pin docs Julia actions to versioned tags so monthly GitHub Actions Dependabot updates can track them.
• Add julia-actions/cache@v3 to docs and benchmark workflows for consistent Julia cache usage.
• Extend the repository configuration regression test for the Wave 1 CI matrix, Julia cache, docs action pins, and Dependabot entries.

Remaining Drift / Exceptions

• Package CI is already named CI and keeps Julia 1.10/1 on Ubuntu plus Julia 1.10/1 on Windows.
• Documentation and benchmark workflows remain repo-specific and non-required for this wave.
• No branch-protection changes are included; those are deferred to Wave 3.

Tests

• git diff --check
• actionlint .github/workflows/ci.yml .github/workflows/docs.yml .github/workflows/benchmark.yml .github/workflows/docscleanup.yml .github/workflows/tagbot.yml
• ruby -e 'require "yaml"; ARGV.each { |path| YAML.load_file(path); puts "YAML parse passed: #{path}" }' .github/dependabot.yml .github/workflows/ci.yml .github/workflows/docs.yml .github/workflows/benchmark.yml .github/workflows/docscleanup.yml .github/workflows/tagbot.yml
• julia --project=. -e 'using Test, TOML; include("test/unit/ci.jl"); test_ci_configuration()'
• julia --project=. -e 'using Pkg; Pkg.test()'

Pkg.test() passed with the existing local manifest warnings about the ignored Manifest.toml being resolved with Julia 1.11.5 and needing resolve/update after compat changes.

Branch Hygiene

• Base branch: main
• Source branch point: origin/main at 26800c8443ab57ed6f7745ababb28c259976f101
• Stacked status: not stacked; no prerequisite PRs

Closes #34

[bernalde]

Maintainer review for PR head 1a76222f45b005e75cff57bf7bb24ba5ac48491e.

No blocking findings.

Blocking issues: None.

Nonblocking issues: None.

Questions: None.

Tests run and outcomes:

• PR-head diff file-set check: local git diff --name-only 26800c8443ab57ed6f7745ababb28c259976f101 HEAD matched gh pr diff 35 --name-only.
• git diff --check 26800c8443ab57ed6f7745ababb28c259976f101 HEAD passed.
• actionlint .github/workflows/ci.yml .github/workflows/docs.yml .github/workflows/benchmark.yml .github/workflows/docscleanup.yml .github/workflows/tagbot.yml passed.
• YAML parse for .github/dependabot.yml and all workflows passed.
• julia --project=. -e 'using Test, TOML; include("test/unit/ci.jl"); test_ci_configuration()' passed.
• julia --project=. -e 'using Pkg; Pkg.test()' passed; the run emitted the existing local manifest warnings about ignored manifests resolved with Julia 1.11.5 / needing resolve after compat changes.
• Changed external action refs checked: julia-actions/setup-julia@v3, julia-actions/cache@v3, and julia-actions/julia-buildpkg@v1 all resolve.
• GitHub checks for the reviewed head are green: all four CI matrix jobs passed, Documentation build passed, and documenter/deploy passed.

Merge-readiness: The PR addresses issue #34's Wave 1 CI/Dependabot baseline, is not draft, and GitHub reports mergeStateStatus as CLEAN. This review is a COMMENT because bernalde authored the PR; this account cannot provide a formal approval if one is required. GitHub did not report a live REVIEW_REQUIRED gate in reviewDecision.