chore(ci): clean up Dependabot config and transfer CODEOWNERS to @nicknacnic

[nicknacnic]

Supersedes #124 — Ingmar's Dependabot cleanup rebased with maintainer handover applied in the same commit.

Dependabot changes (identical to #124)

• Rename group patch-security → patches (rule covers all patches, not security-only)
• Add explicit open-pull-requests-limit: 5 to github-actions block (was the implicit default)
• Drop reviewers: field (GitHub removed it 2025-08-08; CODEOWNERS is the canonical replacement)
• Drop labels: [dependencies, automated] from both ecosystems — relying on Dependabot's default dependencies label. Anything filtering on the automated label will stop matching; this is intentional.

CODEOWNERS changes

• Replace @iracic82 with @nicknacnic across all entries (maintainer handover)
• Add pyproject.toml and uv.lock routing to @nicknacnic @ivanglabbeek — Dependabot pip bumps now surface to both maintainers, matching the github-actions reviewer pair (supply-chain hardening)

Governance docs

• GOVERNANCE.md Committers table updated: @nicknacnic as Project Lead, @IngmarVG-IB as Committer — consistent with CODEOWNERS and MAINTAINERS.md

Lock resync note

The uv.lock hunk moving anyio to 4.15.1 was a pre-existing lock/manifest drift correction, not a new bump introduced by this PR. The explicit floor (anyio>=4.14.2) was landed separately in #271 on pyproject.toml; the lock-only change here may be a no-op after rebase.

Closes #124

[IngmarVG-IB]

Reviewed while unblocking Dependency Audit (#271). The CODEOWNERS transfer itself is mechanical and reads fine, and adding pyproject.toml / uv.lock so pip bumps land on the same reviewer pair as .github/ bumps is a good call.

First, a correction to something I initially flagged and was wrong about. I read the uv.lock hunk

-{ name = "mcp", marker = "extra == 'mcp'", specifier = ">=1.28.1,<2.0.0" },
+{ name = "mcp", marker = "extra == 'mcp'", specifier = ">=1.28.1,<3.0.0" },

as widening the mcp ceiling. It isn't — pyproject.toml on main already declared <3.0.0; it was uv.lock's requires-dist that still recorded <2.0.0. That's pre-existing lock/manifest drift, and this PR is correctly resyncing it. (#271 corrected the same drift as a side effect of re-resolving, so this hunk may now be a no-op on rebase.) Apologies for the noise.

Three things I do think are worth addressing:

1. The anyio bump had no floor behind it. This PR moved uv.lock to anyio 4.15.1 without a corresponding constraint in pyproject.toml, so the next unrelated uv lock could resolve back below the patched version. That mattered because 4.12.1 carries CVE-2026-63374 + CVE-2026-64847. #271 has since landed an explicit anyio>=4.14.2 floor on the core dependencies — httpx is a core dep and pulls anyio, so the base install was in the affected tree, not just [mcp]. So this is resolved, but flagging the pattern: lock-only security bumps don't hold.

2. The PR does more than the title says. "clean up Dependabot config and transfer CODEOWNERS" doesn't signal a dependency bump for two CVEs or a lock resync. On a repo where Dependency Audit is a required check, a security-relevant lock change is worth its own line in the description at minimum.

3. CODEOWNERS will disagree with the governance docs. This makes @nicknacnic the catchall owner and drops @iracic82 from every path, but MAINTAINERS.md and GOVERNANCE.md aren't touched. After this merges those files still describe the previous ownership. Worth updating them in the same PR so there's one source of truth.

Minor: the labels: [dependencies, automated] blocks are removed from both ecosystems. If that's deliberate (relying on Dependabot's default dependencies label) fine — just noting it's a behaviour change bundled under "clean up," and anything filtering issues/PRs on the automated label will stop matching.

[IngmarVG-IB]

Approving. Two of my earlier concerns have resolved themselves and I want the record straight:

• The mcp <2.0.0 → <3.0.0 hunk was not a widening — pyproject.toml already declared <3.0.0 and uv.lock's requires-dist was stale. This was a correct resync. My original reading was wrong.
• Removing the labels: [dependencies, automated] blocks is a fix, not just cleanup: Dependabot has been posting "The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them" on its PRs (visible on #266 since 2026-09-17). Dropping the config resolves that. Worth saying so in the description.
• The lock-only anyio bump is moot now — #271 landed an explicit anyio>=4.14.2 floor on the core dependencies (httpx pulls it, so the base install was affected, not just [mcp]). Standing note for next time: a lock-only security bump doesn't hold, since any later re-resolve can drop back below the patched version.

Adding pyproject.toml and uv.lock to CODEOWNERS so pip bumps reach the same reviewer pair as .github/ bumps is a good call.

One item still genuinely open, not a blocker: this makes @nicknacnic catchall owner and drops @iracic82 from every path, but MAINTAINERS.md and GOVERNANCE.md aren't touched — after this merges they'll describe the previous ownership. Please follow up so there's one source of truth on who maintains what.