ci: pin GitHub Actions and enable updates

[presempathy-awb]

Summary

Pin every third-party GitHub Action used by PageDB workflows to a full 40-byte
commit SHA and add weekly Dependabot maintenance for the github-actions
ecosystem.

This carries only the action-pinning portion identified during review of #24. It
does not change release job dependencies, artifact handling, Cargo publication
flags, version stamping, tests, permissions, runner selection, or workflow
behavior.

Why

Mutable action tags are convenient but allow the code executed by an existing
workflow revision to change after review. Full commit SHAs make each workflow
revision resolve to immutable action source.

Pinning without an update owner would trade one supply-chain risk for silent
staleness. .github/dependabot.yml therefore scans GitHub Actions weekly.
Dependabot understands action references pinned to commit SHAs and updates the
same-line version annotation when it opens an upgrade PR.

Pinned references

Every reference is pinned to the commit behind a published release, and every
release pinned here is the latest one available.

Action	Immutable commit	Version annotation
actions/checkout	3d3c42e5aac5ba805825da76410c181273ba90b1	v7.0.1
actions/upload-artifact	043fb46d1a93c77aae656e7c1c64a875d1fc6a0a	v7.0.1
actions/download-artifact	3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c	v8.0.1
softprops/action-gh-release	3d0d9888cb7fd7b750713d6e236d1fcb99157228	v3.0.2
Swatinem/rust-cache	c19371144df3bb44fab255c43d04cbc2ab54d1c4	v2.9.1
taiki-e/install-action	41049aa56687c35e0afa74eed4f09cec4f9afabf	v2.85.2
crazy-max/ghaction-github-labeler	548a7c3603594ec17c819e1239f281a3b801ab4d	v6.0.0
dtolnay/rust-toolchain	4cda84d5c5c54efe2404f9d843567869ab1699d4	stable

The same SHA is used consistently at every occurrence. Local reusable workflows
such as ./.github/workflows/test.yml remain local references and are
intentionally not rewritten. ci.yml contains only local references, which is
why it is not in the diff.

Annotations name a release, not a moving tag

Swatinem/rust-cache is pinned to the v2.9.1 release commit rather than to the
head of the moving v2 tag. Those are not the same commit: v2 currently points
one changelog-only commit past the v2.9.1 tag, so pinning it would freeze code
that was never cut as a release, behind an annotation (# v2) that does not say
which release it corresponds to. Every annotation in the table above identifies
an exact release so a reviewer can tell what is pinned by reading the line.

crazy-max/ghaction-github-labeler is pinned to v6.0.0, the current release.
The v6.0.0 action.yml keeps the three inputs this repository uses —
yaml-file, skip-delete, dry-run — with unchanged semantics; the major bump
is the node20 to node24 runtime, which the ubuntu-latest image provides.

dtolnay/rust-toolchain is maintained by hand

This action publishes no version series. The workflows pin refs/heads/stable,
whose action.yml defaults toolchain: stable and lets rustup resolve the
current release at run time, so pinning the SHA freezes the action code without
freezing the Rust toolchain. Its only tag, v1, makes toolchain a required
input, so moving to it would break every call site that relies on that default.

Dependabot cannot track a branch pin, so this one action is excluded from the
automated update story rather than silently assumed to be covered. That
limitation and its reasoning are recorded in .github/dependabot.yml beside the
configuration, so the next person to read the file does not have to rediscover
it.

Maintenance behavior

package-ecosystem: github-actions
directory: /
schedule:
  interval: weekly
groups:
  actions:
    patterns: ["*"]
cooldown:
  default-days: 7

The repository root is the documented directory for GitHub Actions updates;
Dependabot scans .github/workflows from there. Version annotations remain on
the same line as each SHA so update PRs retain a human-readable release
reference.

Updates are grouped into a single weekly PR. Ungrouped, eight pinned actions
produce up to the default limit of five separate PRs, each triggering a full
matrix run and each looking identical to the last — the conditions under which
review degrades into rubber-stamping. One grouped PR per week is one reviewable
change.

default-days is the only cooldown key GitHub Actions supports; the
semver-major-days / semver-minor-days / semver-patch-days variants are
ignored for this ecosystem, so only default-days is set. Seven days keeps
freshly published action revisions out of the automated queue while still
producing routine reviewed upgrades. Cooldown never applies to security updates.

No auto-merge rule is added. Action upgrades remain ordinary pull requests
subject to PageDB's existing review and CI.

Verification

Every pinned SHA was resolved independently against the upstream repository with
git ls-remote, peeling annotated tags, and each one matches its annotation.
Each versioned pin was then compared against that action's latest published
release; all seven are current.

actionlint .github/workflows/*.yml
  exit 0

mutable-reference scan across .github/workflows/*.yml
  no external uses outside a 40-byte SHA

.github/dependabot.yml
  parses; keys: cooldown, directory, groups, package-ecosystem, schedule

git diff --check
  exit 0

Zizmor 1.28.0 was run in pedantic mode with strict collection and a
low-or-higher threshold across .github. Current main reports 69 findings,
including 41 unpinned-uses. This branch reports zero unpinned-uses.

The remaining findings are unchanged workflow concerns: artipacked,
template-injection, undocumented-permission, cache-poisoning, concurrency
limits, and excessive permissions. They are deliberately not mixed into this
mechanical pinning PR.

Hosted run
30317289898
completed with all 19 PageDB checks successful on the initial pinning commit,
including the native matrix, invariant lane, six native cross-targets,
wasm32-unknown-unknown OPFS, wasm32-wasip1, every feature combination, both
benchmark packages, docs, Clippy, and the dependency audit. That is the
end-to-end proof that the pinned action references resolve and execute; CI on
this branch re-runs it for the two version bumps.

Scope and review notes

Base: 031db94b4184f464d2dac1c901da05688fd2f7de

Head: 055b5b1ccda355338f3e7d40734c56978d2e0588

Six files change: the new Dependabot policy and the five workflow files that
contained third-party action references. There is no Rust source, Cargo
metadata, lockfile, public API, file-format, runtime behavior, or benchmark
change.

This branch is based on 031db94 and does not include #25. The two do not
overlap: #25 adds run: steps to release.yml and test.yml, while this PR
changes only uses: reference lines in non-adjacent regions, so the merge is
clean and the combined result keeps both.

Runtime and benchmark tests are not applicable to a reference-only workflow
hardening change; GitHub CI remains the end-to-end proof that every pinned
action resolves and executes.