chore(deps): align cooldown at 3 days everywhere

Dependabot relied on the implicit default for all three ecosystems, and
local `bundle update` / `bun install` had no window at all: they would
resolve to a release published minutes ago, quietly diverging from what
CI proposes.

Declaring three days on every path keeps them in sync. A manual update
now resolves to exactly what Dependabot would offer, and the
supply-chain margin holds either way. Security updates are exempt from
Dependabot's cooldown, and the Docker build is unaffected because it
installs from a frozen lockfile.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: ledermann

.github/dependabot.yml

@@ -13,6 +13,8 @@ updates:
       timezone: Europe/Berlin
     open-pull-requests-limit: 10
     versioning-strategy: lockfile-only
+    cooldown:
+      default-days: 3
     allow:
       - dependency-type: direct
       - dependency-type: indirect
@@ -52,6 +54,8 @@ updates:
       timezone: Europe/Berlin
     open-pull-requests-limit: 10
     versioning-strategy: auto
+    cooldown:
+      default-days: 3
     labels:
       - 'dependencies'
       - 'javascript'
@@ -67,6 +71,8 @@ updates:
       interval: 'daily'
       time: '01:00'
       timezone: Europe/Berlin
+    cooldown:
+      default-days: 3
     labels:
       - 'dependencies'
       - 'gh-action'

Gemfile

@@ -1,4 +1,6 @@
-source 'https://rubygems.org'
+# Gem versions must age 3 days before being resolvable, matching the
+# cooldown declared for bundler in .github/dependabot.yml
+source 'https://rubygems.org', cooldown: 3
 
 ruby '~> 4.0'
 

bunfig.toml

@@ -0,0 +1,5 @@
+[install]
+# Supply-chain hardening: only install package versions published at least
+# three days ago, leaving time for malicious releases to be caught and yanked.
+# Matches the cooldown Dependabot applies to the bun ecosystem.
+minimumReleaseAge = 259200 # seconds (3 days)