Dependabot will stop inferring .npmrc [GA]

### Value Prop
Dependabot's automatic `.npmrc` inference for npm private registries has been a persistent source of broken update runs — failing silently due to incorrect lockfile URLs, format changes, or package manager differences. With this release, customers gain explicit control over registry scopes via a new `scope` property in `dependabot.yml`, and Dependabot generates the correct `.npmrc` automatically. This means fewer mysterious failures, less time debugging registry configuration, and more reliable dependency updates out of the box.

### Expected Outcome
We want to eliminate the most common class of npm private registry failures by replacing an unreliable inference mechanism with an explicit, user-defined configuration model. Customers should experience predictable and correct `.npmrc` generation every time, reducing support burden and increasing confidence in Dependabot for enterprise npm workflows. Success looks like a measurable drop in registry-related Dependabot failures and fewer customer-reported issues around private npm registry setups.

路线图 issue 描述了用 dependabot.yml 中显式的 scope 属性替换自动推断 .npmrc，但没有列出任何仓库文件、测试或实现入口。首先定位 Dependabot 配置和 npm registry 生成代码；当新配置能够生成正确的 .npmrc 文件且不依赖推断时，即视为完成。

由索引模型根据 Issue 内容生成。