ci: finish refreshed Dependabot updates

[berntpopp]

Consolidates refreshed Dependabot PRs #48 and #49 after the preceding dependency batch landed.

Changes:

• Pin both reusable container workflows to released genefoundry-router v0.7.6 commit 84c6ac1fc0eb26f7dfa093cc6394eee3c44d4222.
• Preserve immutable workflow pins and the fleet vulnerability policy.

Proof:

• Full local CI passed: 479 passed, 2 skipped.
• Lockfile validation passed.
• Docker build and pinned Trivy 0.70.0 fleet evaluation passed; zero fixable High/Critical findings.