chore: onboard to canonical github policy files

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @arthur-debert

.github/dependabot.yml

@@ -0,0 +1,17 @@
+# Dependabot config — see arthur-debert/release/README.md "Dependabot policy"
+#
+# Application-dependency freshness (cargo) is deliberately not enabled.
+# Major-version sweeps are evaluated as development work, not pushed by a bot.
+# Security exposure for cargo deps is covered by Dependabot security updates,
+# which are enabled per-repo via the GitHub API (not this file).
+#
+# Only github-actions freshness is enabled — old action versions silently
+# break when GitHub deprecates a runtime, so a low-volume freshness stream
+# here is worth the cost.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

.github/workflows/copilot-review.yml

@@ -0,0 +1,15 @@
+name: Copilot Review
+
+on:
+  pull_request:
+    types: [opened, ready_for_review]
+
+jobs:
+  request:
+    if: github.event.pull_request.draft == false && github.event.pull_request.head.repo.fork == false
+    permissions:
+      contents: read
+      pull-requests: write
+    uses: arthur-debert/gh-dagentic/.github/workflows/copilot-review.yml@main
+    with:
+      pr_number: ${{ github.event.pull_request.number }}

cmd/app/main.go

@@ -25,6 +25,7 @@ var rootCmd = &cobra.Command{
 	Short: "Get a value from a structured data file using a dotted path",
 	Long: `dotcat allows you to read a value from a structured data file
 (JSON, YAML, TOML, or INI) using a dot-separated path to the desired key.`,
+	Args: cobra.ArbitraryArgs,
 	RunE: func(cmd *cobra.Command, args []string) error {
 		// If version flag is provided, print version and exit
 		if showVersion {