- dependabot ignore for npm does NOT support wildcards (only groups.patterns
does). The '@tsparticles/*' rule was silently ignored -> v4 bumps kept
landing. Replace with exact scoped names.
- bump actions/checkout v5->v7 (closes dependabot PR #5); the CI failure on
that PR was a stale-branch format-check, not checkout v7.
Open @tsparticles PRs now closed (#9 already closed earlier).