chore(ci): add dependency cooldowns to dependabot and uv

Semgrep's missing-cooldown rules flag Dependabot and uv configs that
apply newly published releases immediately. Dependabot waits seven
days before proposing updates, and [tool.uv] sets exclude-newer to seven
days.

uv.lock was regenerated with uv 0.13.3 (the pinned version). The only
change is the [options] block that records the cutoff: the same 165
packages resolve, and all eight requirements/*.txt exports are
byte-identical to the committed files.

.github/dependabot.yml

@@ -8,6 +8,8 @@ updates:
     directory: /
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7
     groups:
       github-actions:
         patterns:

pyproject.toml

@@ -133,6 +133,8 @@ Changelog = "https://github.com/VocaHQ/vocalinux/releases"
 # Contributors may use uv 0.12 or 0.13. CI and lock/export generation use
 # uv 0.13.3 for reproducible export formatting (see `just lock`).
 required-version = ">=0.12,<0.14"
+# Supply-chain cooldown: wait a week before resolving newly published releases.
+exclude-newer = "7 days"
 
 [tool.setuptools]
 # Resource dirs carry no .py files, but setuptools still treats them as packages.

uv.lock

@@ -10,6 +10,10 @@ resolution-markers = [
     "python_full_version < '3.12' and sys_platform == 'ios'",
 ]
 
+[options]
+exclude-newer = "0001-01-01T00:00:00Z" # This has no effect and is included for backwards compatibility when using relative exclude-newer values.
+exclude-newer-span = "P7D"
+
 [[package]]
 name = "alabaster"
 version = "1.0.0"