ci: keep pinned action SHAs fresh with an automated updater #10

Follow-up to #4, split out at triage.

#4 pins every GitHub Actions uses: ref to an immutable commit SHA — in this repo's
.github/workflows/ci.yaml and in the three template workflows. That closes the supply-chain
hole, but it also means the pins never move again on their own: a SHA cannot pick up an
upstream security fix the way a floating @v4 tag silently does. Without an updater, #4 trades a
mutable-ref risk for a stale-dependency risk.

The usual answer is Dependabot's github-actions ecosystem (or Renovate), which opens a PR when a
pinned action releases a new version and rewrites both the SHA and the trailing # vX.Y.Z comment
that #4 establishes as the convention.

Two things to decide before this is buildable, which is why it is filed untriaged rather than
specced:

• Dependabot or Renovate, and whether the config also ships inside template/ so every
  generated project inherits an updater. Shipping it into the template means generated projects
  get update PRs from day one; it also means every generated project gets a bot opening PRs,
  which not every user will want — possibly a copier.yml question rather than an unconditional
  file.
• Whether to also cover the uv / Python ecosystems in the same config, or keep this ticket
  strictly to github-actions so it stays one reviewable PR.

Depends-on: #4