chore(repo): atomic codeql-action bumps and root-artifact hygiene

- dependabot.yml: group github/codeql-action/* so init+analyze always bump
  in one PR; a mixed-version pair deterministically fails CodeQL's analyze
  post-action step (seen on open dependabot #157/#158)
- .gitignore: schema-migration flock (.*.migration.lock, held live while
  the server runs) plus regenerable root-level diagnostic dumps
  (/404_paths.txt /disk_report.txt /large_files.txt /stats_pm2.txt
  /venv_status.txt /r3.txt)

Author: Coding-Dev-Tools

.github/dependabot.yml

@@ -26,3 +26,9 @@ updates:
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 3
+    groups:
+      # codeql-action's init and analyze steps must always bump together —
+      # a mixed-version pair fails CodeQL's analyze post-action step.
+      codeql-action:
+        patterns:
+          - "github/codeql-action/*"

.gitignore

@@ -114,3 +114,16 @@ cookies.txt
 
 # uv lockfile (generated tooling, not a project dependency)
 uv.lock
+
+# Schema-migration flock lives next to the DB (engraphis/config.py _migration_lock);
+# regenerable runtime state like *.db itself. Held live while the server runs.
+.*.migration.lock
+
+# One-off diagnostic/report dumps that keep landing at the repo root — regenerable
+# command output, never package content (same policy as /_*.mjs above).
+/404_paths.txt
+/disk_report.txt
+/large_files.txt
+/stats_pm2.txt
+/venv_status.txt
+/r3.txt