chore(deps): ignore the transitive versions ccxt exact-pins

ccxt does not use ranges — it exact-pins its entire transitive closure. All 23
of those packages that appear in our lock sit at precisely ccxt's pin, with no
mismatches, so none can move until ccxt itself releases, and ccxt 4.5.68 is
already the latest. Any Dependabot PR touching one is unmergeable by
construction: the pip group PR proposed five of them and died with
ResolutionImpossible on certifi against the ccxt line in the lock.

Re-running the resolver confirms this is the ceiling rather than a stale lock —
pip-compile --upgrade under python:3.11-slim, matching CI, reproduces every one
of those versions, so there is no lock change to make. pydantic-core is in the
same position via pydantic's own == pin, and was the sixth package in that PR.

Ignore the set. ccxt itself is deliberately not ignored: it is the package whose
bump legitimately carries all of them. This suppresses only the automated PRs —
Dependabot alerts come from the dependency graph and are unaffected by this
file, so a CVE in cryptography, urllib3, requests or certifi still surfaces in
the Security tab, where the remedy is a ccxt bump.

.github/dependabot.yml

@@ -30,6 +30,47 @@ updates:
       # websockets<16, so a bump to 16.x is unresolvable. Drop this once
       # langgraph-sdk widens its range.
       - dependency-name: "websockets"
+      # ccxt does not use ranges — it exact-pins (``==``) its entire transitive
+      # closure, and every one of the 23 packages below is currently held by it
+      # at precisely the version in our lock. None of them can move until ccxt
+      # itself releases, so a Dependabot PR touching any of them is unmergeable
+      # by construction: PR #882 proposed five of them and died with
+      # ResolutionImpossible. Verified by re-running the full resolver
+      # (`pip-compile --upgrade`, Python 3.11 on Linux) — it reproduces these
+      # exact versions, so this is the resolver's ceiling and not a stale lock.
+      #
+      # This suppresses only the automated PRs. Dependabot *alerts* come from
+      # the dependency graph and are unaffected by this file, so a CVE in
+      # cryptography/urllib3/requests/certifi still surfaces in the Security
+      # tab — the remedy there is to bump ccxt, which carries the whole set.
+      # Drop an entry here if ccxt ever loosens that pin.
+      - dependency-name: "aiohappyeyeballs"
+      - dependency-name: "aiohttp"
+      - dependency-name: "aiohttp-fast-zlib"
+      - dependency-name: "aiosignal"
+      - dependency-name: "attrs"
+      - dependency-name: "certifi"
+      - dependency-name: "cffi"
+      - dependency-name: "charset-normalizer"
+      - dependency-name: "coincurve"
+      - dependency-name: "cryptography"
+      - dependency-name: "frozenlist"
+      - dependency-name: "idna"
+      - dependency-name: "multidict"
+      - dependency-name: "orjson"
+      - dependency-name: "propcache"
+      - dependency-name: "pycparser"
+      - dependency-name: "requests"
+      - dependency-name: "setuptools"
+      - dependency-name: "typing-extensions"
+      - dependency-name: "urllib3"
+      - dependency-name: "uvloop"
+      - dependency-name: "yarl"
+      - dependency-name: "zlib-ng"
+      # pydantic-core is exact-pinned by pydantic (``pydantic-core==2.46.4``),
+      # so it only ever moves as part of a pydantic release. It was the sixth
+      # and last package in #882.
+      - dependency-name: "pydantic-core"
 
   # Frontend npm dependencies.
   - package-ecosystem: "npm"