Use dependabot and drop support for Julia < 1.10

[devmotion]

Drops support for Julia < 1.10 and replaces CompatHelper with dependabot.

• .github/dependabot.yml gains the julia ecosystem, with all Julia package updates grouped into one daily PR. The CompatHelper workflow is removed.
• A Downgrade workflow runs the test suite against the declared lower bounds.
• Test dependencies move from [extras]/[targets] to test/Project.toml, with [workspace] projects = ["test", "docs"] in the root.
• julia = "1.10", and the CI matrix tests min-patch instead of min. Base.div(::TrackedReal, ::TrackedReal, ::RoundingMode) is now defined unconditionally, and SPARSE_CAT_AMBIGUITY drops its VERSION >= v"1.10" half.

The lower compat bounds are raised to versions that work. One of them is required, not bookkeeping:

StaticArrays = "1.6.4". JacobianConfig builds its tracked output buffer with similar(output, TrackedReal{D,D,Nothing}) and fills it element-wise in track!. TrackedReal is never isbitstype: it is a mutable struct, and it holds the InstructionTape. MArray fakes element assignment with unsafe_store! into its single NTuple field, so it only supports setindex! for isbits eltypes. StaticArrays returns a SizedArray from similar for non-isbits eltypes from 1.6.4 on; 1.6.3 and earlier return an MArray, whose setindex! errors with

setindex!() with non-isbitstype eltype is not supported by StaticArrays. Consider using SizedArray.

Pinning both versions confirms it: 1.6.3 reproduces the error, 1.6.4 returns a SizedArray. So hessian!(::DiffResult, f, ::MVector) and the corresponding jacobian! path require 1.6.4. Without the bound the Downgrade job resolves a StaticArrays that cannot run them. #295 fails on the same code path, on Julia 1.0, where the resolver picks StaticArrays 1.3.6.

Statistics becomes a package extension

Statistics was a hard dependency for exactly one method, mean(::TrackedArray), and its two instruction hooks. Those move to ext/StatisticsExt.jl.

Nothing is lost by making it weak. ReverseDiff does not export or re-export mean, so reaching the method requires the name, and every route to it already loads Statistics: using Statistics, a qualified Statistics.mean, or a package such as StatsBase that re-exports it and depends on it. The extension loads exactly when the method can be called.

In return ReverseDiff stops loading Statistics for everyone, which also stops it triggering StaticArraysStatisticsExt downstream, since StaticArrays is a hard dependency that takes Statistics as a weakdep. Measured with @time_imports, that is ~1.2 ms plus ~1.3 ms against a ~1740 ms using ReverseDiff — small, so the argument is the accurate dependency declaration rather than the load time.

The tests assert the extension is absent before using Statistics and present after. Without that, a broken extension would go unnoticed: TrackedArray <: AbstractArray, so the generic mean falls through to the tracked sum and still returns the right value and gradient while recording a different instruction. This is not hypothetical — it happened during development against a stale manifest.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.53%. Comparing base (33cd287) to head (5fb518c).

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #292      +/-   ##
==========================================
- Coverage   86.07%   85.53%   -0.54%     
==========================================
  Files          18       19       +1     
  Lines        1967     1964       -3     
==========================================
- Hits         1693     1680      -13     
- Misses        274      284      +10     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.