Cap validate matrix parallelism and stagger Dependabot schedules #317

On 2026-10-05 about ten Dependabot PRs started validate.yml within five minutes. Many validate and suite jobs ended cancelled with no steps run, annotated "The job was not acquired by Runner of type hosted even after multiple attempts". The affected PRs were #310, #311, #314, #315 and #316. Every job that got a runner passed.

There are two causes:

• All eight ecosystems in .github/dependabot.yml use interval: weekly with no day or time, so they all open PRs at the same moment.
• Bump the minor-and-patch group across 9 directories with 14 updates #310 (the npm group) changes the root package.json/package-lock.json. That makes the frameworks job pick every framework, so one PR queues about 100 jobs.

Change

1. Add max-parallel: 10 to the strategy of the validate and suite jobs in .github/workflows/validate.yml. One PR then takes at most 10 runners and the rest of its jobs wait in order.
2. Give each ecosystem in .github/dependabot.yml its own schedule.day so their PRs arrive on different days. Put npm on a day of its own, because its root-manifest PRs validate every framework.

Since validate.yml changes, this PR's own run validates every framework. That run also tests the max-parallel cap.

Done when

• The validate and suite matrices declare max-parallel.
• No two ecosystems in dependabot.yml share a schedule day, except where there are more ecosystems than weekdays. In that case pair the small ones and keep npm alone.
• The PR's own validate run completes with no "not acquired by Runner" cancellations.

Filed by Agent Driver from chat ab79790e.