ci(actions): pin actions to SHAs + dependabot; harden cat-file/env-bind (#181 #198 #199)

[SUaDtL]

Lane B of the tribunal remediation campaign — CI/supply-chain. .github/-only, no plugin payload change (no version bump).

• CI workflows reference third-party GitHub Actions by mutable tag, not pinned commit SHA #181 (security, supply-chain): every uses: in all workflows pinned to a 40-hex commit SHA (# vX.Y.Z comment retained); new .github/dependabot.yml watches the github-actions ecosystem weekly. Write-scoped workflows (release.yml contents:write; docs.yml deploy pages:write+id-token:write) done first.
• nit(ci): version-bump-sandbox cat-file probe conflates absent (exit 1) with fatal (exit 128) #198 (nit): ci.yml cat-file probe distinguishes rc==1 (absent) from fatal (exit 128) — no longer swallows a fatal git error as first-introduction.
• nit(ci): env-bind steps.v.outputs.* in release.yml run: blocks for uniform expansion-free workflows #199 (nit): release.yml step outputs env-bound in run: blocks — zero ${{ }} expansion in any run body, completing the Interpolate release.yml workflow_dispatch inputs into the run shell (script injection) #174 CWE-78 hardening.

security-reviewer: PASS — 0 findings; all 25 uses: verified 40-hex, env-bind complete, YAML parses.

Closes #181
Closes #198
Closes #199

https://claude.ai/code/session_01PVTCDji6bEuf9SifQ8tfsa