chore: harden automation and upstream verification

[yaacovcorcos]

What changed

• makes ordinary product CI validate source topology without failing merely because official Synara moved
• adds --require-reviewed-tip as an honest strict review-closeout mode while retaining --review-check as a strict compatibility alias
• adds real temporary-Git-repository coverage for valid and invalid review/integration ancestry
• adds negative coverage for wrong remotes, writable upstream, missing commits, and stale review checkpoints
• pins every external GitHub Action workflow dependency to a full reviewed commit SHA
• adds weekly Dependabot updates for pinned GitHub Actions

Why

The previous --review-check mode calculated unreviewed commits but did not enforce review currency, while ordinary CI invoked that ambiguous mode. Write-capable and release workflows also used mutable major-version action tags, including a third-party action under pull_request_target.

Impact

Product CI remains healthy when upstream publishes new optional input. A disposition-review closeout now has a strict command that fails until reviewedThrough equals the fetched official tip. Workflow dependencies are immutable at execution time and remain maintainable through Dependabot.

Validation

• focused upstream verifier suite: 9 tests passed
• strict reviewed-tip check passed against the fetched official tip
• Scient identity check passed
• full formatter check passed
• full lint completed with 0 errors (pre-existing warnings remain)
• all 9 workspace typecheck tasks passed
• all workflow and Dependabot YAML parsed successfully
• no mutable action refs remain under .github/workflows/
• git diff --check