ci(deps): add Dependabot config and bump sharp to 0.33

[platex-rehor-bot]

Summary

Addresses RHCLOUD-50315 (FIND-003 and partial FIND-003/sharp bump).

• Add .github/dependabot.yml with npm (weekly, limit 10) and github-actions (weekly, limit 5) ecosystems
• Bump sharp from ^0.32.5 to ^0.33.5 — moves to a maintained release line

Not included (requires manual action)

The following acceptance criteria require modifying .github/workflows/ files, which the bot's GitHub PAT cannot push (missing workflow scope):

• FIND-001 (Medium): Scope pages: write and id-token: write permissions to the deploy job only; add permissions: contents: read to the build job in deploy.yml
• FIND-002 (Low): Pin all uses: references in deploy.yml and ci.yml to full 40-character commit SHAs

These changes should be applied manually or by a user with a PAT that includes the workflow scope.

Test plan

• CI build passes (astro check + astro build)
• Dependabot opens its first batch of PRs within a week
• sharp resolves to 0.33.x in package-lock.json

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Configured weekly automated updates for npm dependencies and GitHub Actions.
  • Updated the image processing dependency to a newer version.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 4325f9fc-511d-42d0-b5b0-782a302c7698

📥 Commits

Reviewing files that changed from the base of the PR and between d91ffa2 and 755dd83.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (2)

• .github/dependabot.yml
• package.json

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request adds weekly Dependabot updates for npm packages and GitHub Actions. It also updates the sharp dependency from ^0.32.5 to ^0.33.5.

Changes

Dependency maintenance

Layer / File(s)	Summary
Dependency update configuration and version .github/dependabot.yml, package.json	Dependabot now checks npm packages and GitHub Actions weekly with separate pull request limits. sharp now requires version ^0.33.5.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 755dd

The dependency update and Dependabot configuration introduce no established merge-blocking risk.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes both main changes: adding Dependabot configuration and updating the sharp dependency to version 0.33.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[tylercreller]

LGTM