fix(dependabot): correct drifted labels and restore github-actions ecosystem

Version/JS PRs were tagged with "python"/"javascript" labels that no longer
exist in the repo (renamed to lang:python/lang:javascript), so Dependabot
silently dropped them. Also re-adds the github-actions ecosystem, removed
unintentionally in a5f9d7b, so CI action bumps (actions/checkout,
codeql-action, etc.) get tracked automatically again.

Author: overwrite00

.github/dependabot.yml

@@ -13,7 +13,7 @@ updates:
     rebase-strategy: auto
     labels:
       - dependencies
-      - python
+      - lang:python
 
   # Node.js (Electron)
   - package-ecosystem: npm
@@ -25,7 +25,7 @@ updates:
     rebase-strategy: auto
     labels:
       - dependencies
-      - javascript
+      - lang:javascript
     ignore:
       # tar vulnerabilities - no upstream fix available
       # These are false positives for a desktop app: hardlink traversal/symlink poisoning
@@ -46,4 +46,23 @@ updates:
     rebase-strategy: auto
     labels:
       - dependencies
-      - javascript
+      - lang:javascript
+
+  # GitHub Actions (CI/CD workflow dependencies)
+  - package-ecosystem: github-actions
+    directory: /
+    target-branch: develop
+    schedule:
+      interval: weekly
+      day: monday
+      time: "04:00"
+      timezone: UTC
+    open-pull-requests-limit: 5
+    rebase-strategy: auto
+    labels:
+      - dependencies
+      - type:ci
+      - scope:deps
+    commit-message:
+      prefix: "ci(deps)"
+      include: scope