chore: align Dependabot npm cooldown with the Yarn minimal age gate

[cryptodev-2s]

Explanation

.yarnrc.yml sets npmMinimalAgeGate: 4320, so Yarn refuses to install any package published less than 3 days ago, and npmPreapprovedPackages exempts @metamask/*, @metamask-previews/* and @lavamoat/* from that gate. Dependabot's cooldown exists to stop it proposing a version the gate would reject, but the npm block applied default-days: 3 to everything with no exclusions, so the two configs did not actually line up.

In practice it was backwards. The npm block only allows @metamask/*, and those are exactly the packages Yarn pre-approves, so the cooldown was delaying the one group that needs no delay by three days and delaying nothing else, because nothing else is allowed through. This adds an exclude list matching npmPreapprovedPackages so the two files say the same thing.

Today that is mostly a latency win on MetaMask package bumps. It matters more under WPC-1161, where we drop the @metamask/* allowlist so Dependabot bumps third party packages too. Those are the ones Yarn actually gates, and default-days: 3 is what keeps Dependabot from opening a pull request that cannot install.

I left the github-actions block alone. Its cooldown is a separate policy call and has nothing to do with the Yarn npm gate.

One gap this does not close

Per the options reference, "the cooldown option is only available for version updates, not security updates". So a Dependabot security update can still propose a version younger than 3 days, and yarn install will reject it for a reason unrelated to the bump itself. Nothing in dependabot.yml can prevent that. Worth knowing before we widen the allowlist, since security updates are already the path that produces our most awkward pull requests.

Verification

Config only, so no behaviour to run. I checked the YAML parses and that both files agree:

yarn npmMinimalAgeGate      : 4320 min = 3 days
dependabot default-days     : 3 days                          match

yarn npmPreapprovedPackages : @lavamoat/*, @metamask-previews/*, @metamask/*
dependabot cooldown exclude : @lavamoat/*, @metamask-previews/*, @metamask/*   match

References

Part of WPC-1161, following #10225.

Checklist

• I've updated the test suite for new or updated code as appropriate (config only)
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed (no published package is touched)
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

---

Note

Low Risk
YAML-only Dependabot configuration with no application or CI logic changes.

Overview
Aligns Dependabot’s npm cooldown with Yarn’s 3-day npmMinimalAgeGate so version-update PRs are not proposed for packages Yarn would refuse to install.

Adds cooldown.exclude for @metamask/*, @metamask-previews/*, and @lavamoat/*, matching npmPreapprovedPackages in .yarnrc.yml, plus inline comments explaining the mirror. MetaMask-family bumps can proceed without an extra 3-day Dependabot delay; third-party bumps (when the allowlist widens) still respect default-days: 3. The github-actions Dependabot block is unchanged.

^{Reviewed by Cursor Bugbot for commit 12d07b1. Bugbot is set up for automated code reviews on this repo. Configure here.}