chore(dependabot): cap open pull requests per update block (#53)

Adds `open-pull-requests-limit` to Dependabot update blocks that had no
cap, following the estate per-ecosystem cap doctrine (task #37). No
other line in the file is touched.


Claude-Session: https://claude.ai/code/session_011eQ7hibx92N7fBDtwgReWk

<!--
SPDX-License-Identifier: CC-BY-SA-4.0
Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
-->
## Summary

<!-- Briefly describe what this PR does and why. Link to related issues
with "Closes #N". -->

## Changes

<!-- List the key changes introduced by this PR. -->

-

## RSR Quality Checklist

<!-- Check all that apply. PRs that fail required checks will not be
merged. -->

### Required

- [ ] Tests pass (`just test` or equivalent)
- [ ] Code is formatted (`just fmt` or equivalent)
- [ ] Linter is clean (no new warnings or errors)
- [ ] No banned language patterns (no TypeScript, no npm/bun, no
Go/Python)
- [ ] No `unsafe` blocks without `// SAFETY:` comments
- [ ] No banned functions (`believe_me`, `unsafeCoerce`, `Obj.magic`,
`Admitted`, `sorry`)
- [ ] SPDX license headers present on all new/modified source files
- [ ] No secrets, credentials, or `.env` files included

### As Applicable

- [ ] `.machine_readable/STATE.a2ml` updated (if project state changed)
- [ ] `.machine_readable/ECOSYSTEM.a2ml` updated (if integrations
changed)
- [ ] `.machine_readable/META.a2ml` updated (if architectural decisions
changed)
- [ ] Documentation updated for user-facing changes
- [ ] `TOPOLOGY.md` updated (if architecture changed)
- [ ] `CHANGELOG` or release notes updated
- [ ] New dependencies reviewed for license compatibility
(PMPL-1.0-or-later / MPL-2.0)
- [ ] ABI/FFI changes validated (`src/interface/abi/` and
`src/interface/ffi/` consistent)

## Testing

<!-- Describe how you tested these changes. -->

## Screenshots

<!-- If applicable, add screenshots or terminal output demonstrating the
change. -->

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: hyperpolymath

.github/dependabot.yml

@@ -13,6 +13,7 @@ updates:
       actions:
         patterns:
           - "*"
+    open-pull-requests-limit: 2
 
   # Rust/Cargo
   - package-ecosystem: "cargo"
@@ -22,24 +23,28 @@ updates:
     ignore:
       - dependency-name: "*"
         update-types: ["version-update:semver-patch"]
+    open-pull-requests-limit: 0
 
   # Elixir/Mix
   - package-ecosystem: "mix"
     directory: "/"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 3
 
   # Node.js/npm
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 3
 
   # Python/pip
   - package-ecosystem: "pip"
     directory: "/"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 3
 
   # Nix flakes
   - package-ecosystem: "nix"