GitHub Actions hygiene: deprecated Node runtimes, stale pins, no Dependabot

The reusable workflows in this repo pin several GitHub Actions to versions that either run on Node runtimes GitHub has deprecated, or haven't received security patches in years. There is also no Dependabot configuration, so these pins only move on manual bumps — which is how the current deprecations built up.

Two PRs address this:

- **Enable Dependabot**: #29 — adds `.github/dependabot.yml` so action versions are surfaced automatically as they age.
- **Bump actions to current**: #30 — resolves the immediate Node 16 EOL footprint and moves Node 20 actions forward.

This issue is the umbrella context for both PRs.

## Current footprint

### Node 16 — [deprecated in 2024](https://github.blog/changelog/2023-09-22-github-actions-transitioning-from-node-16-to-node-20/), currently producing warnings/errors

- `actions/checkout@v3` → `release-tag.yml`
- `docker/setup-buildx-action@v2` → `release-publish-docker-image.yml`
- `docker/login-action@v2` → `release-publish-docker-image.yml`
- `docker/build-push-action@v3` → `release-publish-docker-image.yml`

### Node 20 — deprecation track, [enforcement expected June 2026](https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/)

- `actions/checkout@v4` (6 call-sites)
- `actions/setup-python@v5` (2 call-sites)
- `astral-sh/setup-uv@v5` (7 call-sites)
- `softprops/action-gh-release@v1`, `@v2` (2 call-sites)
- `EndBug/add-and-commit@v9` (4 call-sites)
- `TriPSs/conventional-changelog-action@v5` (1 call-site)
- **`mathieudutour/github-tag-action@v6.2`** — already latest; stuck on Node 20 with no newer upstream release

### Already on Node 24 — fine as-is

- `actions/checkout@v5` (3 call-sites)
- `actions/github-script@v9`

## Why this matters beyond Node runtime

Keeping shared actions current isn't just runtime hygiene — it has a real security dimension, amplified by the fact that this repo publishes *reusable* workflows.

1. **Unpatched CVEs in bundled dependencies.** Actions are compiled JavaScript with npm deps baked in; those deps get CVEs (prototype pollution, ReDoS, archive-extraction bugs) and upstream cuts new releases to ship the patch. Pinning to Node-16-era versions means running code that hasn't had a security patch in 2+ years.
2. **Token-handling hardening.** `actions/checkout@v6` explicitly adds credential-persistence hardening that older versions lack. `docker/login-action` has had several iterations around credential handling. Older versions aren't broken — they're missing fixes.
3. **Log-injection / command-injection patches.** Actions that consume untrusted input (branch names, tag names, PR bodies) have had cases where metacharacters broke out into shell context. Patches land quietly in minor/patch releases.
4. **Supply-chain attacks on the action itself.** E.g. `tj-actions/changed-files` in March 2025 — compromised repo, moved floating major tag, consumers pinned to `@v1` pulled malicious code. Dependabot doesn't prevent this, but staying current means running binaries whose release process has been audited recently.
5. **Reusable-workflow amplification.** Every downstream caller inherits this repo's pins. A compromised action in one reusable can fan out across every consuming project in the org. The reusable model concentrates trust; it should therefore concentrate update discipline.

## Known follow-up: `mathieudutour/github-tag-action`

This action is already at its latest release (`v6.2`) and still runs on Node 20. The bump PR cannot fix it. When GitHub enforces Node 20 deprecation, `release-bump-version.yml` and `tag.yml` will begin failing. Two paths forward, for a separate conversation:

1. Wait for upstream to release a Node 24 version.
2. Migrate to a different tag action — which overlaps with #22 (TriPSs `feat!:` bug) and #26 (`chore:` bump bug). Both would be resolved by migrating the version-bump flow to `commitizen-tools/commitizen-action`, though that project is also currently on Node 20.

Flagging here so the mathieudutour dependency doesn't get lost once the bump PR lands.

## Why two PRs rather than one

Separating concerns:

- The Dependabot config is a small, safe, clearly-scoped addition that should land quickly even if the bump PR needs discussion.
- The bump PR touches 13 workflow files and has specific review items (the provenance-by-default change in `docker/build-push-action@v4+`, `astral-sh/setup-uv@v7` vs `@v8` pinning-style discussion, etc.).

Both PRs cross-reference this issue and each other.