Exclude supply-chain eval fixtures from Dependabot scans (#245)

* Exclude supply-chain eval fixtures from Dependabot scans

The supply-chain-risk-auditor evals assert on deliberately stale
manifests — requests==2.19.0, flask==1.0.2, axios@0.21.0 are the
findings the cases expect. A Dependabot bump would leave the cases
passing with nothing left to detect.

No block scans them today: the uv directories are listed explicitly,
and the Cargo.toml and package.json fixtures have no matching
ecosystem entry. This guards against a later edit widening that list.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Update dependabot.yml

added the slash

* Update dependabot.yml

removing slash because dependabot breaks with it

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

.github/dependabot.yml

@@ -32,6 +32,14 @@ updates:
       - /plugins/testing-handbook-skills/scripts
       - /plugins/trailmark/skills/slicing-code-context/scripts
       - /plugins/yara-authoring/skills/yara-rule-authoring/scripts
+    # supply-chain-risk-auditor's eval fixtures are deliberately stale manifests —
+    # requests==2.19.0 and flask==1.0.2 are the findings those cases assert on, so a
+    # bump would quietly turn a real eval into one nothing can fail. Nothing scans
+    # them today: the directories above are explicit, and the Cargo.toml and
+    # package.json fixtures have no matching ecosystem block at all. This is a guard
+    # against a later edit widening that list, not a fix for PRs already arriving.
+    exclude-paths:
+      - plugins/supply-chain-risk-auditor/evals/fixtures/**
     schedule:
       interval: weekly
     cooldown: