Restore repo files dropped by the v2 tree swap (dependabot, issue template, .gitattributes, CoC)

[cliffhall]

Fourth instance of the same pattern as #1843 (SECURITY.md), #1850 (claude.yml / .mcp.json), and #1864 — the v2 tree swap replaced the default branch's tree, and anything that existed only in the v1 tree was silently dropped from both main and v2/main.

A full sweep of the pre-swap tree (ac3c1a12) against v2/main found 14 such files. Ten are correctly gone; four are worth restoring.

Restore (rewritten or byte-for-byte)

File	Disposition	Why
.github/dependabot.yml	rewrite	Real functional loss: weekly github-actions version updates stopped. The npm security PRs seen on 2026-07-28 (#1833, #1840) are not evidence it works — security updates come from repo settings, not this file, and ran while it was missing entirely. v1's config covered only github-actions at /; v2 has six npm manifests (root + four clients).
.github/ISSUE_TEMPLATE/bug_report.md	rewrite	Under the issues-only policy the template is the primary intake, and it's gone — every report arrives unstructured. v1's asked for "Inspector Version e.g. 0.16.5" with no client field and no v1/v2 routing question.
.gitattributes	byte-for-byte	42 bytes: package-lock.json linguist-generated=true, collapsing lockfiles in diffs. More valuable in v2 — six lockfiles now.
CODE_OF_CONDUCT.md	byte-for-byte	So GitHub surfaces it as a community standard. CONTRIBUTORS.md links the org CoC, so this closes a UI gap, not a policy gap.

Correctly gone (no action)

.prettierrc and .git-blame-ignore-revs are 0-byte files. .prettierignore lists v1 paths, superseded by the explicit format globs plus verify:format-coverage. .husky/pre-commit conflicts with the deliberate npm run ci gate and husky isn't a v2 dependency. cli_tests.yml / e2e_tests.yml are superseded by main.yml. sample-config.json is superseded by docs/mcp-server-configuration.md + test-servers/configs/. .npmrc only pins the public registry. .node-version (22.x.x) is less precise than engines: >=22.19.0.

CONTRIBUTING.md is handled separately by renaming CONTRIBUTORS.md to that name — that lights up GitHub's contributing banner without leaving two files to keep in sync.

Notes

• Dependabot reads its config from the default branch. This file is inert on v2/main until the next milestone merge carries it to main. Same property that keeps claude.yml (Claude Code workflow (.github/workflows/claude.yml) and .mcp.json lost in the v2 tree swap — @claude no longer triggers #1850) dormant.
• Dependabot PRs can't reference an issue, so they're a standing exception to the "every PR references an issue" rule. Worth a sentence in AGENTS.md if we want the rule to be literally true.

[cliffhall]

Closed by #1871, merged to v2/main. (Closing manually: Closes #N only auto-closes for PRs targeting the default branch, and v2 PRs target v2/main.)