Suggestion: optional comment-only second opinion on Dependabot PRs

## Why I'm writing

This repo regularly gets Dependabot npm upgrade PRs. Maintainers still have to triage changelog / supply-chain risk by hand for each one.

## Optional tool (opt-in)

[dep-second-opinion](https://github.com/lory69060/dep-second-opinion) is a **comment-only** GitHub Action: it posts a structured second opinion on dependency upgrade PRs and **never** edits `package.json` / lockfiles.

Pin (Path A):

```yaml
- uses: lory69060/dep-second-opinion@v0.2.0
```

Install notes: https://github.com/lory69060/dep-second-opinion/blob/main/docs/install.md

Happy to close this if it's not a fit — no hard sell, just a suggestion.