CI is the safety gate — auto-merging action updates is circular since
a broken update approves itself. Invert the policy to auto-merge
patch+minor for all ecosystems except github_actions.

The ecosystem name uses underscore (github_actions) because
fetch-metadata derives it from the branch name, not dependabot.yml.

Pin schedule to 06:00 America/Chicago for predictable update timing.
Set open-pull-requests-limit to 10 for both gomod and github-actions.

go-mod-tidy runs on commit to catch untidy modules before CI.
go-test-short runs on push only to avoid slowing down commits.

Uses files pattern instead of types: [go] so go.mod/go.sum-only
changes also trigger the hooks. Adds default_install_hook_types
so pre-commit install sets up both pre-commit and pre-push hooks.

Disable errorlint asserts/comparison checks — the CLI uses sentinel
errors and type assertions like the SDK. Set max-issues-per-linter
and max-same-issues to 0 so lint output is never silently truncated.