chore(deps): propose Cloudflare provider updates with Dependabot

.github/dependabot.yml

@@ -10,3 +10,11 @@ updates:
       # devantler-tech actions/workflows are our own code — bump now, no cooldown.
       exclude:
         - "devantler-tech/*"
+  - package-ecosystem: opentofu
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    cooldown:
+      # Third-party provider releases wait a week, as third-party actions do.
+      default-days: 7

README.md

@@ -93,19 +93,16 @@ variables. Keep all three out of shell history and repository files.
 
 ## Dependency updates
 
-This repository configures Renovate to propose Cloudflare provider updates
-and maintain the OpenTofu lock file using `registry.opentofu.org`. Provider versions remain exact pins;
-updates require the existing CI and review gates and are never auto-merged.
-Dependabot continues to manage GitHub Actions.
-
-The OpenTofu runtime stays on the reviewed 1.12.x line. Renovate's Terraform
-runtime updates are disabled because they track a different product. Every
-provider proposal must pass `scripts/test.sh`, including the destructive-plan
-guard. Dependency automation has no production credentials or apply path.
-
-Validate changes to these rules with Renovate's repository configuration
-validator on its supported Node 24 runtime:
-
-```sh
-npx --yes --package=renovate@44.125.1 renovate-config-validator --no-global --strict renovate.json
-```
+Dependabot proposes updates to the Cloudflare provider and to the GitHub
+Actions this repository uses, as configured in `.github/dependabot.yml`. For
+the provider it uses its OpenTofu support, which also refreshes the provider
+checksums in `.terraform.lock.hcl`. Provider versions remain exact pins. A new
+third-party release waits seven days before Dependabot proposes it as a version
+update; the wait does not apply to Dependabot security updates, which GitHub
+offers for the Actions but not for OpenTofu providers. Updates require the
+existing CI and review gates and are never auto-merged.
+
+The OpenTofu runtime stays on the reviewed 1.12.x line; no updater changes it.
+Every provider proposal must pass `scripts/test.sh`, including the
+destructive-plan guard. Dependency automation has no production credentials or
+apply path.