ci(dependabot): update the two coverage-upload pins in one pull request

.github/dependabot.yml

@@ -15,6 +15,18 @@ updates:
       # devantler-tech actions/workflows are our own code — bump now, no cooldown.
       exclude:
         - "devantler-tech/*"
+    groups:
+      # actions/run-dotnet-tests inlines the coverage-upload step, and CI
+      # (test-run-dotnet-tests-coverage-inline-lockstep) requires its pin to equal the one in
+      # actions/upload-coverage. Ungrouped, Dependabot opens one PR per directory and each fails
+      # on the other's file. A group alone still yields one PR per directory; group-by makes it
+      # one PR across every directory above, so both pins move together. That holds for
+      # version updates only: Dependabot documents group-by as not applying to security
+      # updates, which still arrive per directory and need the other pin moved by hand.
+      coverage-upload-lockstep:
+        group-by: dependency-name
+        patterns:
+          - "actions/upload-code-coverage"
   # The govulncheck allowlist self-test fixture (.github/tests/govulncheck-allowlist)
   # DELIBERATELY pins a vulnerable golang.org/x/text v0.3.0 so the CI self-test
   # (ci.yaml: test-govulncheck-allowlist-honored / test-govulncheck-strict-blocks)