ci: harden Dependabot dependency refreshes

[jmcte]

Summary

• Consolidate the pending immutable workflow dependency updates from PRs chore(deps): bump OMT-Global/bootstrap/.github/workflows/release-publish-reusable.yml from d9c5bc7e50f4bcc97e4b4d3d2efc64e4ab3dca50 to 05296606785553deb8f36e4f18313076dfc9646d #102-chore(deps): bump actions/checkout from 4.3.1 to 4.4.0 #106.
• Require an authenticated Dependabot PR plus GitHub-verified Dependabot commit provenance before skipping human-only metadata gates.
• Keep checked-in workflows, canonical renderer output, CodeQL action versions, and regression fixtures synchronized.

Governing Issue

Closes #108.

Validation

• TMPDIR=/tmp npm run check (24 test files, 204 tests passed)
• npm run build
• bash scripts/ci/check-action-pins.sh (42 immutable pins passed)
• Ruby parse of every checked-in workflow YAML file
• git diff --check origin/main...HEAD
• Exact-branch autoreview against current origin/main completed cleanly with no accepted/actionable findings (confidence 0.90).
• Required PR checks are expected to satisfy CI Gate.

Autoreview command and result: /Users/johnteneyckjr./.codex/skills/autoreview/scripts/autoreview --mode branch --base origin/main --stream-engine-output — clean, no findings.

Bootstrap Governance

• Changes are scoped to issue Harden and consolidate Dependabot workflow refreshes #108's dependency refresh and governance-bypass repair.
• Generated workflows and src/archetypes.ts carry the same policy and pins.
• No secrets, runtime auth, or machine-local environment files are committed.
• The reviewer-found PR-owner, signed-commit provenance, and CodeQL init/analyze consistency blockers were accepted and fixed.

Material change: yes
ADR: docs/decisions/ADR-0005-public-repository-security-baseline.md

Merge Automation

• Auto-merge is enabled with squash merge for the reviewed head.

Notes

This PR supersedes #102, #103, #104, #105, and #106. Those branches mix valid dependency bumps with generated-file drift or insufficient Dependabot provenance checks; they should close only after this replacement merges.

[jmcte]

Exact-head evidence for d6f4797bec8d856c0e906da6ea4d37140e72a830 against main b0871261b0a6a576f3e7627c938279e54099d351:

• TMPDIR=/tmp npm run check: 24 test files, 204 tests passed.
• npm run build: passed.
• bash scripts/ci/check-action-pins.sh: 42 pins passed.
• Workflow YAML parse and git diff --check origin/main...HEAD: passed.
• Exact-branch OpenAI autoreview: clean, no findings, overall confidence 0.90.
• Live Fast Checks, secret validation, action-pin validation, PR description, and Dependabot commit verification: passed.
• Governance count: 180 lines; sole failure is PRS-INDEPENDENT-REVIEW-001.

Review history: accepted and fixed PR-owner authentication, GitHub-verified commit provenance, and CodeQL init/analyze version consistency findings. The final review found no actionable issue.

[jmcte]

@athena-omt @pheidon please review exact head d6f4797bec8d856c0e906da6ea4d37140e72a830.

All code and provenance checks pass; the sole failing governance rule is the required independent approval. Exact-head OpenAI autoreview is clean at 0.90 confidence, and auto-merge is armed. This PR closes #108 and, once merged, safely replaces #102-#106.

[athena-omt]

Approved for d6f4797. Reviewed the full diff, generated workflow call paths, Dependabot verifier pagination/fail-closed logic, and adjacent tests. Local validation passed: 24 test files / 204 tests, TypeScript build, action-pin validation (42 pins), workflow YAML parsing (16 files), and diff whitespace checks. The current Governance/CI Gate failures are the expected missing independent-review evidence; no code blocker found.