chore: restore repo files dropped by the v2 tree swap

[cliffhall]

Closes #1870

Fourth instance of the #1843 / #1850 / #1864 pattern. Full sweep of the pre-swap tree (ac3c1a12) against v2/main found 14 dropped files; ten are correctly gone (rationale in #1870), these four are worth having.

.github/dependabot.yml — rewritten

Not a restore. v1's config covered only github-actions at /; this covers that plus the six npm manifests v2 actually has (root + four clients), since v2 is not a workspace.

Per your direction: monthly (v1 was weekly) and targeting v2/main, not the default branch. Also grouped to one PR per ecosystem/directory to keep the volume sane, and labeled v2 so the version-label rule holds for bot PRs too.

Two properties worth knowing:

• Dependabot reads this from the default branch (main). It is inert on v2/main until the next milestone merge carries it over — the same dormancy as claude.yml in ci: restore the Claude Code workflow and .mcp.json, lost in the v2 tree swap #1869.
• target-branch scopes version updates only. Security updates are a repo setting and always target the default branch — they kept running while this file was missing entirely (build(deps): bump the npm_and_yarn group across 5 directories with 12 updates #1833, build(deps): bump the npm_and_yarn group across 5 directories with 2 updates #1840 on 2026-07-28). Worth re-confirming security updates still appear after this lands, since GitHub documents target-branch as affecting security-update behavior for the configured ecosystem/directory.

.github/ISSUE_TEMPLATE/bug_report.md — rewritten

Under the issues-only policy this is the primary intake path, and it's been missing. v1's version asked for "Inspector Version e.g. 0.16.5", with no client field and no v1/v2 question. The new one leads with the two routing decisions (which version, which client), asks for transport / protocol era / OAuth when a server is involved, reminds people to redact secrets, and ends with the prompt-not-a-diff path pointing at CONTRIBUTORS.md.

Kept as a markdown template rather than converting to a YAML issue form — a form could enforce fields and auto-apply the v1/v2 label, which is tempting given 154 open issues currently carry neither, but that's a bigger change and belongs with the triage work, not here.

.gitattributes — byte-for-byte

42 bytes: package-lock.json linguist-generated=true. The pattern has no slash, so it matches at any depth — all six lockfiles. More valuable in v2 than v1, as dependency PRs are mostly lockfile churn.

CODE_OF_CONDUCT.md — byte-for-byte

Verbatim upstream Contributor Covenant, so GitHub surfaces it as a community standard. Deliberately left unformatted: it's upstream text, v1 listed it in .prettierignore for exactly that reason, and no v2 format glob reaches root markdown — npx prettier --check flags it, but nothing in validate does.

Not included

CONTRIBUTING.md — handled by renaming CONTRIBUTORS.md to that name instead, which lights up GitHub's contributing banner without two files to keep in sync.

Testing

No source files touched, so nothing in validate or coverage measures this. The dependabot config parses (6 entries, all monthly, all target-branch: v2/main, all labeled v2).

🤖 Generated with Claude Code

https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU

[Copilot]

Pull request overview

Restores key repository meta/config files that were lost during the v2 tree swap, reintroducing Dependabot version-update configuration, a bug-report intake template, linguist handling for lockfiles, and a repo-level Code of Conduct so GitHub surfaces community standards correctly.

Changes:

• Add a rewritten .github/dependabot.yml to cover GitHub Actions plus each v2 npm manifest directory and target updates to v2/main.
• Add a rewritten .github/ISSUE_TEMPLATE/bug_report.md to restore structured bug-report intake aligned with the issues-only workflow.
• Restore .gitattributes (lockfiles as generated) and CODE_OF_CONDUCT.md (Contributor Covenant) at the repo root.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
CODE_OF_CONDUCT.md	Restores repo-level Contributor Covenant Code of Conduct so GitHub recognizes community standards.
.github/ISSUE_TEMPLATE/bug_report.md	Restores a structured bug-report issue template tailored to v1/v2 + client routing and common debugging details.
.github/dependabot.yml	Reintroduces Dependabot version-update configuration for GitHub Actions and each npm manifest directory, targeting v2/main.
.gitattributes	Marks package-lock.json as generated to reduce diff noise from lockfile churn.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[cliffhall]

Addressed in 5d6f3d9, though the docs point the other way from your reading.

GitHub's Dependabot options reference states that the configuration options "also change how Dependabot creates pull requests for security updates, except where target-branch is used", and repeats the carve-out per option ("unless target-branch defines updates to a non-default branch"). So an entry whose target-branch names a non-default branch is not applied to security updates at all — target-branch does not redirect where a security PR is opened; it excludes that entry from security-update handling, leaving those PRs on the default branch (which is what we observed empirically in #1833 / #1840, raised while this file was missing entirely).

The original comment was right on the outcome but vague on the mechanism, which is a fair hit. It now spells out the documented rule: entries with a non-default target-branch are not applied to security updates, so the schedule/labels/groups here shape version updates only — plus a note to re-confirm security PRs still appear after this lands. Config values are unchanged.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (2)

.github/dependabot.yml:7

• The header comment says main is “release-only” and takes milestone merges from v2/main, but the repo docs describe main as the legacy v1 branch (README.md:17). This comment could mislead future maintainers; consider rewording it to only state the verified behavior: Dependabot reads config from the default branch, so this file won’t take effect until it exists on main.

# Version updates target `v2/main` (the develop branch), not the default
# branch — `main` is release-only and takes milestone merges from `v2/main`.
#
# Two things to know about this file:
#   1. Dependabot reads it from the DEFAULT branch (`main`). Changes here are

.github/ISSUE_TEMPLATE/bug_report.md:14

• The template asks reporters to apply the v2/v1 label, but most external reporters won’t have permission to set labels. It’s clearer to ask them to select the version in the checklist and note that maintainers will label it during triage.

Issues are how work reaches the Inspector — we accept issues, not pull
requests. See CONTRIBUTORS.md for the full policy.

Please label this issue `v2` (or `v1`, if it is a security or bug fix for the
deprecated v1 line). When in doubt, it's `v2`.

[cliffhall]

Round 2 Copilot review: no new inline comments, two suppressed ones — both correct, both fixed in c7fbf35.

dependabot.yml:7 — "main is release-only" contradicts the repo docs. Right, and it was my error. README.md:17 and AGENTS.md both describe main as the legacy v1 implementation taking security and bug fixes only; the "release-only, takes milestone merges" framing is where the branches are headed, not where they are. Reworded to match the docs, keeping the operative point (Dependabot reads config from the default branch, so this file is inert until it lands on main).

bug_report.md:14 — reporters can't apply labels. Also right — issue labels need triage/write permission, which external reporters do not have, so the instruction was unactionable for its intended audience. The template now asks only for the version checkbox and says a maintainer applies the v1/v2 label during triage.

Re-validated the config after the edit: 6 entries, all monthly, all target-branch: v2/main, all labeled v2 — unchanged. Only comments and prose moved.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

[cliffhall]

Reverting the branch description from c7fbf350 in the commit just pushed.

That round-2 fix changed the dependabot comment to say main "still holds the legacy v1 implementation and takes only security and bug fixes," on the grounds that README.md:17 and AGENTS.md say so. Those are exactly the stale sentences #1866 exists to correct — main stopped being the legacy v1 implementation at the go-live tree swap. It is the release branch holding the latest released v2; the deprecated v1 line lives on v1/main.

So the original wording ("release-only") was right and the correction made it wrong. Now reworded to state the full model explicitly rather than leaning on a cross-reference that was itself broken.

The other half of c7fbf350 stands — asking bug reporters for the version checkbox instead of asking them to apply a v1/v2 label they have no permission to set was a genuine catch.

Worth noting for the other PRs in this batch: this is the third time today an agent has "corrected" true text to match documentation that #1866 is in flight to fix. Until #1866 merges, v2/main's README and AGENTS.md are not a reliable source for how the branches work.