chore(ci): group Dependabot updates + document SHA verification and PR stacking

[grubmeshi]

Top of the Dependabot action-bump stack (#206 → #214 → #213 → #212 → this).

• .github/dependabot.yml: add wildcard groups: to both ecosystems so future updates arrive as one combined PR per ecosystem (github-actions incl. majors) instead of one PR per dependency — so this manual re-stacking is not needed next time.
• .agents/skills/github-ci/SKILL.md: when introducing a new action, resolve the latest release SHA rather than copying a stale SHA from a template/old example (root cause of actions landing several majors behind on day one).

Merging the whole stack: fast-forward main to this branch —
git push origin chore/dependabot-grouping-and-ci-skill:main — which lands all five PRs at once (GitHub auto-closes each as merged).

🤖 Generated with Claude Code

[github-actions]

📊 Test Coverage

Scope	Coverage
Unit tests (mock client)	73.9%
Combined (unit + acceptance)	79.9% — ✅ acceptance passed

Uncovered functions (combined run)

github.com/meshcloud/terraform-provider-meshstack/client/api_key_permissions.go:225:							AllApiKeyPermissions				0.0%
github.com/meshcloud/terraform-provider-meshstack/client/buildingblock.go:89:								Read						0.0%
github.com/meshcloud/terraform-provider-meshstack/client/buildingblock.go:93:								Create						0.0%
github.com/meshcloud/terraform-provider-meshstack/client/buildingblock.go:97:								Delete						0.0%
github.com/meshcloud/terraform-provider-meshstack/client/client.go:47:									NewApiTokenAuthorization			0.0%
github.com/meshcloud/terraform-provider-meshstack/client/internal/logging.go:27:							Debug						0.0%
github.com/meshcloud/terraform-provider-meshstack/client/internal/logging.go:31:							Info						0.0%
github.com/meshcloud/terraform-provider-meshstack/client/internal/logging.go:35:							Warn						0.0%
github.com/meshcloud/terraform-provider-meshstack/client/internal/retry.go:225:								Close						0.0%
github.com/meshcloud/terraform-provider-meshstack/client/internal/retry.go:246:								Write						0.0%

Combined with go tool covdata merge over the unit and acceptance coverage data. The acceptance suite runs ./internal/provider against the live backend; coverage is attributed across all packages (-coverpkg=./...).