Add `concurrency: stats-${{ github.ref }}` with `cancel-in-progress:
false` so the next scheduled or push-triggered run queues behind
the current one instead of racing on the same checkout.

Supersedes #7 (the branch in #7 had a confusing diff because it
inherited the merged deps bump from #6).

- requests 2.33.0 → 2.34.2
- pytest 9.0.3 → 9.1.1
- actions/checkout v4 → v7.0.0
- actions/setup-python v5 → v6.3.0

Pillow unchanged (already at 12.2.0).

All 40 tests pass locally and CI green.

Replace open(path).read() with Path(path).read_text() in
render_techstack._icon_svg and render_connect._mono_asset so the
file descriptors are properly released.

Verified with `python -W error::ResourceWarning -m pytest`: 40 passed,
0 ResourceWarnings (was 70 before).

Refs: #4

- requests 2.31.0 → 2.33.0 (CVE-2026-25645)
- Pillow 12.1.1 → 12.2.0
- pytest 8.2.0 → 9.0.3

Dependabot commands:
@dependabot rebase / @dependabot recreate

Remove the pytest 9.x ignore rule so future major bumps are
proposed and can be tested in CI.

- Schedule daily (Mon-Fri 09:00 Europe/Madrid) for both pip and
github-actions ecosystems.
- Group minor/patch updates to reduce PR noise; keep major bumps
isolated for careful review.
- Auto-assign dependabot PRs to @jmrplens (matches the existing
auto-assign workflow).
- Ignore pytest 9.x major upgrade (breaking changes pending review).