Supply-Chain

Dependency updates are security work, but only if the process is quiet enough that people keep reading the diffs. The usual failure mode is not a missing bot. It is too many pull requests, no triage, and no clear rule for what gets merged first.