Group Dependabot pip and Actions updates

## Task

`.github/dependabot.yml` allows 5 open PRs per ecosystem with no groups, so each bump is a separate PR (see #3–#6).

## Scope

Add Dependabot `groups` for:
- pip patch/minor
- github-actions

Keep the weekly schedule. Do not hide security updates if the config lets you split them.

## Acceptance criteria

- [ ] Valid dependabot.yml
- [ ] Limits still sane (do not raise to unbounded)
- [ ] One-line note in CONTRIBUTING or the PR template

Start with .github/dependabot.yml and inspect its existing ecosystems, weekly schedule, and open-PR limits. Add groups for pip patch/minor and github-actions while preserving sane limits and security updates where supported, then validate the configuration. Add the required one-line note in CONTRIBUTING or the PR template and confirm the acceptance criteria are met.

Written by the indexing model from the issue text.