- Expand dependabot coverage across Rust subcrates and other ecosystems. - Group updates per dependency and ignore vendored mimalloc crates. - Pin GitHub Actions to exact SHAs in existing workflows.