ci(deps): hold Electron at 43 while armv7l Linux packages ship

Electron 44 publishes no linux-armv7l binary, so the 44.x update fails
the Linux packaging jobs on the armv7l AppImage, DEB and Snap targets.
Ignore Electron majors in Dependabot until 32-bit ARM support is
dropped deliberately; 43.x minor and patch updates still arrive.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/dependabot.yml

@@ -1,10 +1,11 @@
 # Every Dependabot PR triggers the full pipeline (~15 jobs), so version
 # updates are batched weekly. Nx minor+patch updates use a dedicated group so
 # official packages move together; Nx majors are manual coordinated migrations.
-# Native packaging, parser, and version-locked playback dependencies stay in
-# standalone PRs; other minor+patch updates are grouped per ecosystem. Security
-# updates are separate and are not limited by this schedule; CI enforces complete
-# Nx lockstep.
+# Electron majors are held while Linux armv7l packages ship: Electron 44
+# dropped the linux-armv7l binary. Native packaging, parser, and
+# version-locked playback dependencies stay in standalone PRs; other
+# minor+patch updates are grouped per ecosystem. Security updates are separate
+# and are not limited by this schedule; CI enforces complete Nx lockstep.
 version: 2
 updates:
     - package-ecosystem: npm
@@ -21,6 +22,9 @@ updates:
           - dependency-name: '@nx/*'
             update-types:
                 - version-update:semver-major
+          - dependency-name: electron
+            update-types:
+                - version-update:semver-major
       groups:
           nx-version-updates:
               applies-to: version-updates

docs/architecture/workspace-shell.md

@@ -878,6 +878,9 @@ Toolchain notes for the Electron 43 baseline:
    Those dependencies require standalone PRs so their dedicated package,
    worker, playback, and diagnostic-contract validation cannot be hidden by an
    unrelated grouped update.
+   Electron majors are ignored: Electron 44 ships no `linux-armv7l` binary,
+   and the release still packages armv7l AppImage, DEB and Snap builds. Remove
+   the ignore together with those targets when 32-bit ARM support is dropped.
 4. Electron 42 and newer download their development binary on the first
    Electron command instead of during package `postinstall`, so `electron`
    must not remain in pnpm's `onlyBuiltDependencies` allowlist. The first local