fix(ci): version image dependency updates

[fqjony]

Summary

• Rename the dependency workflows to rabbit / reviewer and rabbit / updater.
• Keep the reviewer read-only: it does not merge Dependabot changes to Dockerfile, package.json, or package-lock.json.
• Require those image-input updates to be consolidated in one release PR with the next npm minor version.
• Align the existing Rabbit Docker dependency updater with the minor-version policy.

Validation

• Parsed both workflow YAML files.
• Parsed the Review Dependabot PRs and Bump package minor version shell steps with bash -n.
• Verified the image-input predicate against Docker PR Bump usabilitydynamics/udx-worker-nodejs from 0.35.0 to 0.36.0 #192, npm PR Bump brace-expansion #195, and Actions-only PR Bump actions/setup-node from 6 to 7 in /.github/workflows #193.
• Ran a dry review from this branch: image-input PRs were release-gated and the Actions-only PR remained eligible.
• Ran git diff --check.

[Copilot]

Pull request overview

This PR updates the repository’s CI automation around dependency maintenance by renaming the workflows to rabbit / updater and rabbit / reviewer, and aligning both workflows on a “bump npm minor version when Dockerfile pins change” policy (including an automated write-back flow for Dockerfile-only Dependabot PRs).

Changes:

• Renames the dependency workflows and aligns workflow-generated messaging with the new names.
• Changes the Docker dependency updater workflow to bump the npm minor version (instead of patch) when Dockerfile pins change.
• Enhances the Dependabot reviewer workflow to optionally push a minor-version bump commit for Dockerfile-only PRs (gated on DEPENDABOT_REVIEWER_TOKEN) and to require fresh checks before merge.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
.rabbit/README.md	Updates documentation to reflect the renamed workflows and the minor-version bump policy/write-back behavior.
.github/workflows/docker-dependency-updater.yml	Renames updater workflow and switches the Dockerfile-change version bump from patch → minor.
.github/workflows/_dependabot-actions-review.yml	Renames reviewer workflow and adds automation to push a minor version bump for Dockerfile-only Dependabot PRs, plus related reporting/artifacts.

Suppressed comments (2)

.github/workflows/_dependabot-actions-review.yml:238

• git worktree add cannot create a worktree nested inside the current repository worktree. With checkout_dir under ${work_dir} (which is .tmp/... inside the repo), this will fail and the version-bump path will never succeed.

                (.status != "COMPLETED") or

.github/workflows/_dependabot-actions-review.yml:338

• After pushing the version-bump commit, changed_files (and the PR details used for comment update detection) are still based on the pre-push gh pr view output. This can cause the workflow comment/report to list the wrong changed files (e.g., only Dockerfile) even though package.json / package-lock.json were just added by the automation.

              status="${line:0:2}"
              path="${line:3}"

              if [ "${status}" = "??" ]; then
                case "${path}" in

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (1)

.github/workflows/_dependabot-actions-review.yml:280

• This block overwrites result with a new needs release decision that isn’t otherwise handled (only safe has a dedicated path), and it also discards the original classify_status reason (e.g., pending/failing checks). If the intent is simply “do not auto-merge these PRs”, consider reusing the existing needs validation decision and appending the release-gate message while preserving the original reason text.

            if changes_image_input "${details_path}"; then
              result="needs release|Image-input dependency changes require a single release PR with the next npm minor version before merge"
            fi