GitHub Actions: SHA-pinned path-based action with no version tags does not update to latest branch commit

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Package ecosystem

Github Actions

### Package manager version

n/a

### Language version

n/a

### Manifest location and content before the Dependabot update

Path:

`.github/workflows/repro.yml`

Content:

```yaml
name: repro

on:
workflow_dispatch:

jobs:
test:
runs-on: ubuntu-latest
steps:
- name: Repro action
uses: example-org/action-repo/.github/actions/test@aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
```

The important part is that:

* aaaaaaaa... is a commit on the action repo's default branch
* it is not associated with any semver-like tag
* the repo has a newer commit on the same branch, for example bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
* the repo has no semver-like tags at all

The source action repository looks like this:
```
example-org/action-repo
└── .github/
└── actions/
└── test/
└── action.yml
```

with an action.yml like:

```yaml
name: test
description: test action
runs:
using: composite
steps:
- run: echo hello
shell: bash
```

The source repo has no semver-like tags for this action.

### dependabot.yml content

```
version: 2
updates:
- package-ecosystem: github-actions
directory: /
schedule:
interval: weekly
```

### Updated dependency

_No response_

### What you expected to see, versus what you actually saw

Expected:

Dependabot should open a PR updating:

```
uses: example-org/action-repo/.github/actions/test@aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
```

to:

```
uses: example-org/action-repo/.github/actions/test@bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
```

because the pinned commit is not associated with any version tag and the docs say GitHub Actions dependencies pinned to an untagged commit should update to the latest commit.

Actual:

Dependabot opens no PR for this dependency. Other GitHub Actions dependencies in the same repository continue to update normally.

### Native package manager behavior

_No response_

### Images of the diff or a link to the PR, issue, or logs

_No response_

### Smallest manifest that reproduces the issue

`dependabot.yml`:
```yaml
version: 2
updates:
- package-ecosystem: github-actions
directory: /
schedule:
interval: weekly
```

`.github/workflows/repro.yml`:
```yaml
name: repro

on:
workflow_dispatch:

jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: example-org/action-repo/.github/actions/test@aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
```

Minimal source repository requirements:

* contains `.github/actions/test/action.yml`
* default branch has at least two commits, a... then newer b...
* no semver-like tags resolve the pinned SHA

Shortest high-signal explanation:
* The bug is in the SHA-pinned GitHub Actions path when `latest_version_tag` is `nil`.
* Existing behavior handles branch refs and tagged SHAs, but not untagged SHAs with repo-path actions.
* The updater should fall back to `latest_commit_for_pinned_ref` or equivalent branch-head resolution instead of returning no update.

Note:
* The setup here did work as recently as Dec 2025

Start in the GitHub Actions updater path described by the issue, focusing on handling when latest_version_tag is nil and on latest_commit_for_pinned_ref or its equivalent. Reproduce the case with .github/workflows/repro.yml and dependabot.yml using an untagged SHA for a path-based action. Done means Dependabot proposes an update from the pinned commit to the newer default-branch commit.

Written by the indexing model from the issue text.