Ensure Dependabot updates target staging, not production

[daveio]

Dependabot automated pull requests should be configured to target the staging branch rather than production.

Why

Dependabot PRs merging directly into the production branch bypasses the staging environment, skipping validation and risking unvetted dependency updates reaching production.

Acceptance Criteria

• Dependabot configuration (.github/dependabot.yml) updated to target the staging branch
• Verify existing open Dependabot PRs are retargeted if necessary
• Confirm future Dependabot PRs are raised against staging

[linear]

AFF-3