fix(ci): ensure Dependabot PRs include yarn.lock updates

Problem:
- Dependabot was updating package.json without yarn.lock
- canary.yml failed with 'lockfile would have been modified' error
- dev.yml incorrectly passed by skipping install on cache hit

Solution:
- Add versioning-strategy: increase to dependabot.yml for all npm ecosystems
- Remove conditional install in dev.yml to always validate lockfile
- Add cache step id to canary.yml for consistency

This ensures:
1. Dependabot generates complete PRs with lockfile updates
2. Both workflows consistently validate lockfile integrity
3. Out-of-sync dependencies are caught early in CI

resolve #284

Author: JeremyDev87

.github/dependabot.yml

@@ -7,6 +7,7 @@ updates:
       interval: 'weekly'
       day: 'monday'
     open-pull-requests-limit: 10
+    versioning-strategy: increase
     labels:
       - 'dependencies'
       - 'security'
@@ -30,6 +31,7 @@ updates:
       interval: 'weekly'
       day: 'monday'
     open-pull-requests-limit: 10
+    versioning-strategy: increase
     labels:
       - 'dependencies'
       - 'security'
@@ -50,6 +52,7 @@ updates:
       interval: 'weekly'
       day: 'monday'
     open-pull-requests-limit: 10
+    versioning-strategy: increase
     labels:
       - 'dependencies'
       - 'security'

.github/workflows/canary.yml

@@ -35,6 +35,7 @@ jobs:
           node-version: '24'
 
       - name: Restore dependencies from cache
+        id: cache
         uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
         with:
           path: |

.github/workflows/dev.yml

@@ -48,7 +48,6 @@ jobs:
             ${{ runner.os }}-yarn-
 
       - name: Install dependencies
-        if: steps.cache.outputs.cache-hit != 'true'
         run: yarn install --immutable
 
   # ─────────────── CI Jobs (parallel) ───────────────