bounds-bump.yml is removed, and its weekly failure with it

## Summary

`.github/workflows/bounds-bump.yml` cannot run: the repository requires actions
to be pinned to a full-length commit SHA, and the action it calls brings its own
unpinned dependencies. It has failed every weekly run since 2026-08-13 and opens
no pull requests. Delete it.

## Motivation

The workflow dies in *Set up job*, before any step executes:

```
Download action repository 'nomeata/haskell-bounds-bump-action@0ca83f519882bb5cd8ef4c00dd06a4488b302b8f'
##[error]The actions actions/checkout@v3, actions/cache@v3, haskell-actions/setup@v2,
and peter-evans/create-pull-request@v6 are not allowed in alunduil/network-arbitrary
because all actions must be pinned to a full-length commit SHA.
```

`bounds-bump.yml` pins `nomeata/haskell-bounds-bump-action` correctly. The four
rejected actions are that action's own `uses:` entries, which this repository
cannot pin from the outside — nothing short of forking or vendoring the action
changes that.

Weekly `Create Dependency Bump PR` runs on `main`:

| Date | Result |
| --- | --- |
| 2026-07-23 | success |
| 2026-07-30 | success |
| 2026-08-06 | success |
| 2026-08-13 | [failure](https://github.com/alunduil/network-arbitrary/actions/runs/31682200660) |
| 2026-08-20 | [failure](https://github.com/alunduil/network-arbitrary/actions/runs/32347449678) |
| 2026-08-27 | [failure](https://github.com/alunduil/network-arbitrary/actions/runs/33066808507) |

The capability is already gone — this has not opened a bump pull request in
three weeks. What remains is a scheduled job that fails every Thursday and puts
a red mark on the default branch for a reason unrelated to any change in it.
Removing it costs nothing that still works and takes the false signal with it.

## Scope

- Delete `.github/workflows/bounds-bump.yml`.
- Check whether `Create Dependency Bump PR` is named as a required status check
anywhere, and drop the requirement if so.
- Leave the bump capability itself to #101.

## Out of scope

Restoring automated bounds bumps. #101 carries that.

## Acceptance criteria

- [ ] `.github/workflows/bounds-bump.yml` no longer exists
- [ ] No branch protection or ruleset references the removed workflow
- [ ] The default branch shows no scheduled failure the following week
- [ ] Pre-commit passes

## Additional context

The SHA-pinning requirement is deliberate and stays — see the sibling work in
`alunduil/woodland-generators` (#473 for pinning at commit time, #482 for
verifying third-party composite actions are pinned all the way down). This
repository is the case #482 describes, reached from the other direction: the
ruleset caught an action whose internals are unpinned, and the action is the
thing that gives.

Vendoring or forking `haskell-bounds-bump-action` with its internals pinned
would also satisfy the ruleset. That is not proposed here because #101 already
prefers Renovate over maintaining a fork of a single-purpose action.

Found while triaging default-branch CI failures across repositories for the
fortnight to 2026-08-29.