ci: security-only Dependabot + weekly poetry.lock updates

[blink1073]

References

Same pattern as Calysto/octave_kernel#357

Description

Dependabot's pip lane has been failing outright: toml-rb cannot round-trip the mixed string/table array in [dependency-groups].dev, so it dumps the array as a Ruby literal and then fails to reparse its own output (dependabot/dependabot-core#14517). Splitting the group into homogeneous arrays fixes the crash.

With that unblocked, routine version bumps move to a weekly poetry.lock refresh and Dependabot is narrowed to security updates, which keeps pull request noise down. The new workflow calls this repo's own poetry-lock-update action, so we dogfood it on a schedule instead of only in tests.

Changes

• Split [dependency-groups].dev into dev and dev-extra so no array mixes strings with tables. The installed set is unchanged.
• Restricted the Dependabot pip lane to security updates.
• Added a weekly poetry.lock update workflow, also runnable on demand.

Backwards-incompatible changes

None

Testing

• just lint-all passes, including actionlint on the new workflow.
• poetry install --with dev --dry-run still resolves both pytest and pre-commit, confirming the group split preserves the dev set.
• The lock diff is group-membership metadata only; no package versions changed. The header moved to Poetry 2.4.1 because that is the local version regenerating it.
• The workflow itself runs only after merge. tests.yml already exercises poetry-lock-update in dry-run mode on every push.

AI usage

• Some or all of the content of this PR was generated by AI.
• The human author has carefully reviewed this PR and run this code.
• AI tools and models used: Claude Code (Opus 5)