feat: group alerts by package — investigate/remediate once per package, not per alert

Problem

BLEnder processes each Dependabot alert independently. On a real backlog that's very inefficient because alerts cluster on a few packages.

mozilla/fxa snapshot (100 open alerts): axios 18, undici 12, brace-expansion 9, js-yaml 6, webpack-dev-server 4, postcss 4, immutable 4, ws 3, react-router 3, protobufjs 3 — top 10 packages = 66 of 100 alerts.

Per-alert means:

• N× cost/noise — we observed 18 separate axios investigation runs and multiple duplicate 'not affected' comments on the same PR.
• Multi-major packages can't be fixed per-alert — brace-expansion's 9 alerts span 1.x/2.x/5.x, each with its own patched version. A per-alert bump/resolution conflicts, whereas one yarn up -R brace-expansion bumps all lines correctly in a single pass.

Proposal

Group open alerts by (package, ecosystem) before dispatch:

• Investigate once per package (assess applicability for the package, not per advisory).
• Remediate once per package — a single bump/PR that resolves all of that package's alerts.
• Dedupe comments.

Impact

Roughly 3× throughput on a backlog this shape, proportional Claude-cost reduction, far fewer PRs/comments, and correct handling of multi-major packages. This is the key enabler for BLEnder to actually clear an existing backlog rather than trickle through it one alert at a time.

Start by tracing BLEnder's Dependabot alert dispatch and the package/ecosystem grouping boundary. Use the mozilla/fxa snapshot and the multi-major brace-expansion case as behavioral references. Done means one investigation and remediation flow per package and ecosystem, a single bump resolving that package's alerts, and deduplicated comments.