Summary

Updates all the docs which need to be updated to reinforce our policy about package changes and updates.

Linked issue

N/A

Changes

See above

Checklist

• Tests added or updated (or N/A with reason)
• Docs/types updated if public API changed (index.d.ts and index.d.cts)
• No breaking changes (or called out explicitly above)

Summary by cubic

Clarifies and codifies that package, lockfile, and GitHub Actions version update PRs are maintainer/bot-only, with a 7‑day Dependabot delay unless a critical vulnerability requires a maintainer-led manual update. Updates contributor docs, templates, and config comments to reduce noisy or risky update PRs.

Description

• Summary of changes
  • Updated PR template, CONTRIBUTING.md, COLLABORATOR_GUIDE.md, AGENTS.md, and .github/copilot-instructions.md with the maintainer/bot-only policy and 7-day delay.
  • Added clarifying comments to .github/dependabot.yml.
  • Updated THREATMODEL.md mitigations to include the policy and note the cooldown exception.
• Reasoning
  • Reduce supply-chain risk and review noise from unsolicited update PRs.
  • Make the standing policy explicit and consistent across docs and configs.
• Additional context
  • No runtime or build logic changes. Documentation and comments only.

Docs

Suggest adding a short note under /docs/contributing about:

• Maintainer/bot-only package, lockfile, and GitHub Actions update PRs.
• The 7-day Dependabot delay and the critical-vuln exception.

Testing

No tests added or changed. None needed for docs-only updates.

Semantic version impact

No version impact. Docs-only; no release required.

^{Written for commit c665288. Summary will update on new commits.}