Fix dependabot

[simongdavies]

This pull request updates the Dependabot to exclude hyperlight-dev/js-host-api as this is not yet published with all the changes hyperagent needs

[Copilot]

Pull request overview

Updates Dependabot configuration to better match the repo’s actual manifest locations and to avoid update attempts for a dependency that isn’t meant to be pulled from the registry.

Changes:

• Switch npm and cargo Dependabot entries to multi-directory scanning.
• Add open-pull-requests-limit to each ecosystem.
• Add an npm ignore rule for @hyperlight/js-host-api.

Comments suppressed due to low confidence (1)

.github/dependabot.yml:23

• Including the repo root ("/") in the npm updater will likely still fail because the root package.json depends on "@hyperlight/js-host-api" via a local path (file:deps/js-host-api), but deps/ is gitignored (and not present in the repo checkout). Dependabot runs in a clean checkout and generally needs to resolve local file: dependencies when updating package-lock.json. Consider removing "/" from the npm directories until js-host-api is available via a resolvable source, or vendor/commit a minimal deps/js-host-api package (or switch the dependency to a git URL that Dependabot can fetch).

  - package-ecosystem: "npm"
    directories:
      - "/"
      - "/src/code-validator/guest"
    schedule: