ci: add v1 tag auto-update workflow

[castrojo]

Summary

Automation audit Phase 1: auto-update the v1 tag after every merge to main.

After any PR merges to main, this workflow force-pushes the v1 tag to HEAD so consumers referencing @v1 always get the latest composite actions without requiring manual tag pushes.

What it does:

• Triggers on push to main (post-merge only)
• Checks if v1 already points to HEAD (no-op if yes)
• Force-pushes v1 tag to current HEAD

Risk: None. Worst case, v1 still points to main which is the desired state.

Checklist

• SHA-pinned action (actions/checkout@df4cb... # v6)
• Runs only on post-merge push (not on PRs)
• Idempotent — no-op if v1 already current

Closes #583 (Phase 1 of automation audit).

Assisted-by: Claude Sonnet 4.5 via pi

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/checkout	df4cb1c069e1874edd31b4311f1884172cec0e10	🟢 5.9	Details Check Score Reason Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review 🟢 10 all changesets reviewed Maintained ⚠️ 2 3 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 2 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Packaging ⚠️ -1 packaging workflow not detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected SAST 🟢 8 SAST tool detected but not run on all commits Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches

Scanned Files

• .github/workflows/update-v1-tag.yml