docs(dependabot): describe main as release-only, not "legacy v1"

Reverts the branch description introduced in c7fbf35. That change was made to
match README.md:17 and AGENTS.md — but those are precisely the stale sentences
PR #1866 exists to correct. `main` has not been the legacy v1 implementation
since the go-live tree swap; it is the release branch holding the latest
released v2, and the deprecated v1 line lives on `v1/main`.

So the comment now describes the real model: v2/main is the develop branch,
main is release-only and receives milestone merges, v1/main is maintenance and
takes security fixes only.

The rest of c7fbf35 stands — the bug_report.md change (asking reporters for
the version checkbox rather than to apply a label they lack permission to set)
was a genuine catch.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YAt8rqxysNbhYWLhoRm3fU

Author: cliffhall

.github/dependabot.yml

@@ -1,8 +1,9 @@
 version: 2
 
-# Version updates target `v2/main`, the active development branch, not the
-# default branch — `main` still holds the legacy v1 implementation and takes
-# only security and bug fixes (see README.md "Repo status").
+# Version updates target `v2/main`, the develop branch where all v2 work lands,
+# not the default branch — `main` is release-only, holding the latest released
+# v2 and receiving milestone merges from `v2/main`. (The deprecated v1 line
+# lives on `v1/main` and takes security fixes only.)
 #
 # Two things to know about this file:
 #   1. Dependabot reads it from the DEFAULT branch (`main`). Changes here are