The repository has no explicit Dependabot cooldown, so routine updates
do not follow the 30-day policy used by `setup-uv`. Add
`cooldown.default-days: 30` for npm and GitHub Actions while retaining
the daily schedule. Dependabot security updates remain outside the
cooldown.
Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com>
