Dependency update loop

Automated dependency-bump PRs rot the moment a lockfile-adjacent PR merges ahead of them, or two bumps in the same ecosystem conflict with each other. Left alone, they pile up stale and unreviewable. This is one pass over that backlog — designed to be re-run on an interval via a time-based loop, not to fix everything in one sitting.

Step 1 — Enumerate the backlog

List open PRs from the bot(s) this repo uses (author is a recognizable bot account, or a branch prefix like dependabot/* / renovate/*). For each, capture: ecosystem, branch, base, mergeable state, and whether CI ran at all.

Done when you have that list, oldest first.

Step 2 — Detect the ecosystems in play

Don't assume — check what's actually in the repo:

• Node/Bun/npm/pnpm/yarn: package.json + its lockfile
• Rust: Cargo.toml + Cargo.lock
• Go: go.mod + go.sum
• Python: pyproject.toml/requirements*.txt + poetry.lock/uv.lock