Remove Dependabot action-update grouping from the GitHub Actions standard

[MariusStorhaug]

The GitHub Actions coding standard and the Dependency Updates capability both instruct maintainers to group low-risk action bumps so that several updates arrive in a single pull request. In practice, grouping is not wanted: each dependency bump should arrive as its own pull request so it can be reviewed, tested, and released independently.

Request

Current guidance

• Coding-Standards/GitHub-Actions.md, under Keep pinned actions current: "Apply a cooldown before adopting a freshly published version, and group low-risk action bumps so routine updates arrive as one reviewable pull request rather than many."
• Capabilities/dependency-updates/design.md lists grouping as a configured behaviour in .github/dependabot.yml (config narrative and the Configuration surface table).

Desired guidance

• Grouping is removed from both the standard and the capability. One dependency bump equals one pull request.
• The cooldown guidance is retained — only the grouping half of that bullet is removed.

Why it matters

Each action bump is an artifact-affecting change that cuts its own release. Bundling several bumps into one grouped pull request obscures which bump produced which release and complicates rollback. Individual pull requests keep release attribution clean and reviewable.

Acceptance criteria

• No remaining recommendation to group action or dependency updates in the standard or the capability docs.
• The cooldown recommendation is still present.
• No dependabot.yml example in the docs shows a groups: key.

---

Technical decisions

Scope — documentation only. No code or workflow changes; this reconciles the written standard with the intended practice.

Files to change:

File	Change
src/docs/Coding-Standards/GitHub-Actions.md	In Keep pinned actions current, remove the "group low-risk action bumps…" clause; keep the cooldown clause.
src/docs/Capabilities/dependency-updates/design.md	Remove grouping from the config narrative ("Ecosystems, directories, schedule, cooldown, grouping…") and from the Configuration surface row that lists grouping.
src/docs/Capabilities/dependency-updates/spec.md	Verify — no grouping requirement is stated; adjust only if one is found.
src/docs/Capabilities/dependency-updates/index.md	Verify — no grouping mention; adjust only if one is found.

Cooldown is unaffected and remains recommended.

---

Implementation plan

• Edit Keep pinned actions current in GitHub-Actions.md to drop the grouping clause while retaining the cooldown clause
• Remove grouping references from dependency-updates/design.md (config narrative + Configuration surface table)
• Confirm spec.md and index.md contain no grouping requirement (adjust only if found)
• Search the repo for any groups: example in dependabot.yml snippets and remove it
• Run the docs lint/build pipeline