fix(safety): rename dependency-safety.yml to dep-safety.yml

[j7an]

Summary

Rename .github/workflows/dependency-safety.yml → .github/workflows/dep-safety.yml to force a fresh GitHub Actions workflow registration. The file's name: field stays Dependency Safety (reusable) (from PR #74) — the rename is about getting a clean workflow_id, not about the display label.

Internal-only change. No public-facing version bump. Consumers using @v3 continue to work because the v3 floating tag still points at a commit where the file exists under its original name. This PR does not trigger a release.

Why

The existing workflow ID 281959865 has a stale registered display name (".github/workflows/dependency-safety.yml", the file-path fallback set during the original collision with ci-safety.yml). Four prior attempts to refresh it failed:

PR / action	Effect
#72 rename ci-safety.yml to break the original name collision	refreshed ci-safety.yml's record, not this one
API disable/enable cycle	state advanced; name field unchanged
#73 add doc-comment header (file-touch only)	updated_at advanced; name field unchanged
#74 change name: value from Dependency Safety → Dependency Safety (reusable)	updated_at advanced; name field STILL unchanged

This rules out file-touch, value-change, and admin-state-cycle as triggers. The conclusion is that GitHub's name resolver runs once at initial workflow registration and never re-evaluates the same workflow_id. The only path left is to register a NEW workflow_id by changing the file path.

What this PR changes

File	Change
.github/workflows/dependency-safety.yml → dep-safety.yml	git mv (rename detected by git)
.github/workflows/ci-safety.yml	local uses: path updated to new filename
scripts/check-inline-sync.sh	INLINE_PAIRS entries updated to new filename
.claude/CLAUDE.md	repo-internal docs updated to new filename

What this PR does NOT change (scope discipline)

• Status check context dependency-safety / gate — consumer branch-protection rules requiring this exact name keep working.
• Label names dependency-safety-error (and the security-review-needed / dependency-age-violation siblings) — existing labels on consumer Dependabot PRs are not orphaned.
• HTML scan-comment marker <!-- dependency-safety-${PR_NUMBER} --> — existing scan comments on consumer PRs continue to be found and updated rather than duplicated.
• README.md examples — still show uses: j7an/shared-workflows/.github/workflows/dependency-safety.yml@v3 since @v3 is the current public release.
• .github/workflows/README.md historical v2 note — still accurate; v2 is frozen.
• In-file prose comments inside the workflow — descriptive references to "dependency-safety" remain (the concept name, not the file path).

Test plan

• CI green on this PR (5/5 standard checks). The same residual phantom failures from PR fix(safety): rename workflow name to force registry refresh #74 are expected — they're cosmetic and not in the check rollup.
• After merge: confirm a brand-new workflow_id appears for dep-safety.yml with a properly resolved name field:

  gh api repos/j7an/shared-workflows/actions/workflows --jq \
    '.workflows[] | select(.path | endswith("dep-safety.yml")) | {id, name, path, state}'

  Expected: name: "Dependency Safety (reusable)", NEW id (not 281959865).
• After merge: open a test PR (or wait for the next Dependabot PR) and confirm ci-safety.yml actually launches its safety / scan job again — the dogfood that's been dead since 2026-05-28.
• After merge: confirm no phantom failure runs appear on the merge commit's runs list for dep-safety.yml.
• Old workflow_id cleanup: the previous 281959865 registration may persist as a zombie. Decide later whether to leave it as-is (no-op since no file matches its path) or attempt API deletion.

Release implications

This PR is not intended to ship as a release. If we cut a v3.x.y from this commit, @v3 would move to a tree where dependency-safety.yml no longer exists at the original path — breaking every consumer using the public uses: j7an/shared-workflows/.github/workflows/dependency-safety.yml@v3 line. Decision deferred until:

1. We confirm the rename actually fixes the dogfood.
2. We decide whether to cut v4 (breaking, with migration docs) or back out the rename if it doesn't help.

Until then, main deliberately diverges from the @v3 floating tag. The release-self.yml workflow is dispatch-only, so this divergence is naturally safe.