Tidy Dependabot config: drop dead npm ecosystem and group github-actions updates

## Summary

Dependabot is generating noise in `frmscoe/workflows`. The repo's `.github/dependabot.yml` was seeded from the stock "every TS repo" baseline template, which is written for an npm/TypeScript service. In a workflows-only repo that produces two problems:

1. **Dead `npm` ecosystem block.** The config declares a `package-ecosystem: "npm"` updater at `/`, but this repo has no `package.json` (root is `.codacy.yml`, `.github`, `.markdownlint.json`, `README.md`, `config-templates`, `workflow-docs`). The npm updater has no manifest to act on - it is pure dead config.

2. **Ungrouped `github-actions` updates create PR spam.** The `github-actions` updater is legitimately in scope (this repo is now the central home of the reusable `*-ci.yml` workflows after the stub-architecture migration, so it carries the action pins for the whole fleet). But with no `groups:` set, Dependabot opens one PR per action. That is currently 5 open PRs (#92 setup-node, #93 sbom-action, #94 hadolint-action, #95 codeql-action, #96 upload-artifact) and will keep recurring monthly.

## Why this surfaced now

The central migration (PR #100) moved all reusable `*-ci.yml` workflows into this repo. Those reusables hold the `uses: @` pins for the entire member fleet, so Dependabot's action refs concentrated here and opened a batch.

## Current config

```yaml
version: 2
updates:
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "monthly"
- package-ecosystem: "npm"
directory: "/"
schedule:
interval: "weekly"
```

## Proposed fix

- Remove the `npm` ecosystem block (no manifest exists in this repo).
- Add a `groups:` key to the `github-actions` updater so all action bumps land in a single weekly/monthly PR instead of one-per-action.

Example:

```yaml
version: 2
updates:
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "monthly"
groups:
github-actions:
patterns:
- "*"
```

## Scope note

`.github/dependabot.yml` is a per-repo baseline file, not delivered by `sync-workflows.yml`, so it must be edited directly in this repo (it is not overwritten by the sync). The same stray `npm` block very likely exists in `tazama-lf/workflows` and in the baseline template at `tazama-lf/docs/templates/common/.github/dependabot.yml` - the root-cause fix belongs in the template so new repos stop inheriting it, with a follow-up sweep of any workflows/non-npm repos already seeded from it.

Start with .github/dependabot.yml and compare it with the baseline at tazama-lf/docs/templates/common/.github/dependabot.yml; confirm the repository has no npm manifest and review the existing github-actions updater. Done means the dead npm block is removed and action updates are grouped, with the template and any identified workflows-only copies covered as described.

Written by the indexing model from the issue text.