ci: let Dependabot keep pinned actions up to date

The workflows pin actions to commit SHAs, which also freezes out upstream
fixes. A weekly Dependabot check for the github-actions ecosystem moves the pins.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CaQrWx6zTzc6GBwwm7PYXQ

Author: chengzeyi

.github/dependabot.yml

@@ -0,0 +1,7 @@
+version: 2
+updates:
+  # Actions are pinned to commit SHAs; this keeps the pins moving.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly