fix(ci): re-pin julia-downgrade-compat to v1, and tell Dependabot to leave it (#53)

#47 pinned this action back to v1 after v2 turned main red. Dependabot
re-applied the very same bump in #50 hours later, and main is red again
for exactly the reason #47 diagnosed:

    #47  72a153c  pin back to v1        -> downgrade job success
    #50  745493e  bump v1 -> v2.6.2     -> downgrade job failing again

The bot was doing its job. The mistake was mine: #47 recorded "PINNED TO
v1 ON PURPOSE" as a comment in the workflow, and a comment is not
binding on a bot that cannot read it. The mechanism that is binding is an
`ignore` rule, which this adds:

    ignore:
      - dependency-name: julia-actions/julia-downgrade-compat
        update-types: [version-update:semver-major]

Major bumps of that one action are now ignored; patch and minor updates
within v1 still come through, and every other action is untouched.

Note that #50 left the configuration worse than the v2 attempt in
463ade2 did. That commit at least paired `@v2` with `mode: deps`, which
narrows what gets promoted. Dependabot bumped the version and left the
v1-shaped config, so the action ran in its default `alldeps` mode —
promoting weakdeps and test extras into `[deps]` with nothing holding
them back.

The workflow comment now points at the `ignore` rule, so the next person
to read it knows where the binding statement lives.

Author: s-celles

.github/dependabot.yml

@@ -30,3 +30,18 @@ updates:
       prefix: "chore(ci)"
     labels:
       - dependencies
+    ignore:
+      # julia-downgrade-compat must stay on v1. v2 promotes the weak
+      # dependencies and test extras into `[deps]` to perform one joint
+      # floor-resolve, which makes `Aqua.test_stale_deps` report ten packages
+      # in `deps` that `using Giac` never loads, and takes
+      # `Aqua.test_persistent_tasks` down with it. See the comment in
+      # .github/workflows/CI-Downgrade.yml for the detail.
+      #
+      # This rule exists because a comment in the workflow is not binding:
+      # #47 pinned the action back to v1, and Dependabot re-applied the bump
+      # in #50 within hours, turning main red again for the same reason.
+      # Patch and minor updates within v1 are still welcome.
+      - dependency-name: julia-actions/julia-downgrade-compat
+        update-types:
+          - version-update:semver-major

.github/workflows/CI-Downgrade.yml

@@ -67,14 +67,19 @@ jobs:
       # joint resolve becomes satisfiable — see the note below on why it is
       # not today.
       #
+      # This comment is not enough on its own: Dependabot cannot read it, and
+      # re-applied the v2 bump in #50 within hours of #47 reverting it. The
+      # binding statement is the `ignore` rule for this action in
+      # `.github/dependabot.yml`; keep the two in step.
+      #
       # SCOPE. The `skip` list leaves this testing the hard `[deps]` only.
       # Standard libraries cannot be downgraded independently of Julia. A
       # weakdep floor is a *pairwise* promise — "this extension works against
       # Symbolics 7.0" — but `Pkg.test` resolves the whole test target at
       # once, forcing all five weakdeps to their floors simultaneously, which
       # is unsatisfiable here and is a situation no user meets: you load one
       # extension, not five floor-pinned ones together.
-      - uses: julia-actions/julia-downgrade-compat@v2.6.2
+      - uses: julia-actions/julia-downgrade-compat@v1
         with:
           skip: >-
             Libdl,LinearAlgebra,Random,Test,