v1.3.0 — Node 24 action bumps + dependabot enabled

What changed

Bumps the 5 remaining node20-runtime actions to node24 majors:

Action	Was	Now
docker/build-push-action	v6	v7.1.0
docker/login-action	v3	v4.1.0
docker/setup-buildx-action	v3	v4.0.0
softprops/action-gh-release	v2	v3.0.0
dependabot/fetch-metadata	v2.4.0	v3.1.0

All five major bumps are runtime-only — no API breaks. Verified each pinned SHA exposes using: node24 in its action.yml.

Adds .github/dependabot.yml so future action bumps land via auto-PR (this repo previously had no dependabot — explains why the node20 pins survived).

Why now

• 2026-06-02 — Node 24 becomes the runner default; node20-pinned actions get force-bumped (mostly transparent).
• 2026-09-16 — Node 20 removed from runners; runs.using: node20 actions hard-fail.

Consumer migration

Update your uses: reference to @v1.3.0:

uses: homelabforge/shared-workflows/.github/workflows/python-react-publish.yml@v1.3.0

Affected repos: mygarage, tidewatch, vulnforge, familycircle, myhealth.

Bonus fix

Pre-existing actionlint failure on main (SC2034 in pg-migrations wait loop, introduced in v1.2.0) is also resolved.

🤖 Generated with Claude Code