Pin the Julia supply chain and model the real trust boundaries

.github/dependabot.yml

@@ -1,6 +1,10 @@
 # SPDX-License-Identifier: MPL-2.0
-# Dependabot configuration for RSR-compliant repositories
-# Covers common ecosystems - remove unused ones for your project
+# Dependabot configuration for Statistikles.
+#
+# Only ecosystems that actually exist in this repo are listed. Dependabot has
+# NO Julia ecosystem, so the Julia dependencies (the compute half) are covered
+# by a committed Manifest.toml + CI `Pkg.instantiate`/`Pkg.test`, which resolve
+# from the pinned manifest, instead. See docs/THREAT-MODEL.md.
 
 version: 2
 updates:
@@ -13,39 +17,3 @@ updates:
       actions:
         patterns:
           - "*"
-
-  # Rust/Cargo
-  - package-ecosystem: "cargo"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    # `open-pull-requests-limit: 0` suppresses routine version-update PRs
-    # while leaving Dependabot SECURITY PRs flowing. The previous
-    # `ignore: "*" patch` rule also silenced security PRs under GitHub\'s
-    # current Dependabot behaviour. See rsr-template-repo commit 78b050e
-    # and 007-lang/audits/audit-dependabot-automation-gap-2026-04-17.md.
-    open-pull-requests-limit: 0
-
-  # Elixir/Mix
-  - package-ecosystem: "mix"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-
-  # Node.js/npm
-  - package-ecosystem: "npm"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-
-  # Python/pip
-  - package-ecosystem: "pip"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-
-  # Nix flakes
-  - package-ecosystem: "nix"
-    directory: "/"
-    schedule:
-      interval: "weekly"

.gitignore

@@ -36,7 +36,9 @@ erl_crash.dump
 # Julia
 *.jl.cov
 *.jl.mem
-/Manifest.toml
+# Manifest.toml is COMMITTED here (supply-chain pinning of the compute half;
+# Dependabot has no Julia ecosystem, so the committed manifest + CI
+# Pkg.instantiate is the compensating control). Do not re-ignore it.
 
 # ReScript
 /lib/bs/