Faster, cheaper CI (velocity sweep)

[0thernet]

What changed

• New .github/workflows/ci.yml: check job (setup-bun 1.3.14, bun install --frozen-lockfile --ignore-scripts, bun run check = typecheck + 99 convex-test tests, lockfile-unchanged guard) plus a Required aggregator job. 10 min / 5 min timeouts. Concurrency is per-ref on PRs (superseded PR runs cancel) and per-SHA on main pushes, which are never cancelled.
• New .github/dependabot.yml: github-actions ecosystem, weekly, grouped, at most 2 open PRs.

Evidence (before)

• relay had no CI workflow, only dynamic CodeQL (19.1 min/7 days, public, so not billed). PRs Build the relay foundation #1, Expose device public keys in the peer list #3, Emit cross-language golden vectors #4, Index presence rows by device and connection #5 and Brand OTP email and surface delivery failures #7 merged 5 to 11 s after opening with nothing checked (Brand OTP email and surface delivery failures #7 opened 15:40:47Z, merged 15:40:56Z).
• The sources never import convex/_generated: tsconfig excludes it and test.setup.ts maps ./_generated/server.ts to ./server. So bun run check runs without codegen. Locally: 29 packages install in 148 ms, and 99 tests pass in 143 ms.

Expected after

• About 30 to 45 s wall time per PR or push, mostly runner and setup-bun startup. The repo is public, so these minutes are free.
• Once Required is green, Ben can apply the checked-pr delivery policy (--context Required, L0.4). That step is not part of this PR.

🤖 Generated with Claude Code