GitHub Actions pins frozen 6 days: Dependabot is jammed at its PR limit by five failing PRs

> 🤖 Generated by the Agentic Engineer

## Evidence

GitHub Actions pins in this repository cannot be updated: Dependabot is at its open-PR cap and none of the PRs holding it there can drain. All four conditions for "prevented rather than merely quiet" hold, measured 2026-08-18:

* **At the cap.** `.github/dependabot.yaml` declares `github-actions` on a `daily` schedule and sets **no** `open-pull-requests-limit` anywhere in the file, so the default of **5** applies. There are exactly **5** open `dependabot/github_actions/*` PRs (#6551, #6552, #6553, #6554 from 2026-08-12; #6562 from 2026-08-13). Dependabot cannot open a sixth.
* **Those 5 cannot drain.** Every one is `BLOCKED` and every one carries a failing check. Four fail `🧹 Lint - mega-linter` (#6551, #6552, #6553, #6554). #6553 additionally fails two `🧪 System Test (Docker)` legs and `CI - Required Checks`; #6562 fails `🧪 System Test (Docker) (K3s, Docker, true)` and `CI - Required Checks`.
* **An update is demonstrably available and unproposed.** `devantler-tech/actions` is at **v13.0.9** (published 2026-08-16T19:29:20Z), while the five stuck PRs are still proposing **13.0.5**. Nothing between 13.0.6 and 13.0.9 can be offered.
* **Nothing has merged in this ecosystem for 6 days.** The last was #6557 on 2026-08-12.

## The same failure mode is already recorded in another repository

`devantler-tech/platform#3125` records this exact shape — the same `🧹 Lint - mega-linter` check holding the same ecosystem at the same default cap — jammed there since **2026-07-21**. Worth diagnosing as one cross-repository failure mode rather than two local ones.

## What blocks diagnosis today

The failing check is a **job inside the org-injected `✅ Validate Go Project` workflow** (`.github/workflows/validate-go-project.yaml`, supplied from `devantler-tech/actions`), not a workflow this repository owns. That workflow has since been re-provisioned: the runs still exist and still report `failure`, but their `workflow_id` (`314211171`) now returns **404**, so `gh run view --job --log-failed` cannot retrieve the logs and the reason for the lint failure is currently unreadable from the API.

Recovering a readable failure — by reproducing the linter locally against one of those trees, or from a current run of the same job — is the first real step.

## Note for whoever picks this up

These PRs are **automation-owned**. Do not rebase, re-run, comment on, push to, close, or merge them; that changes Dependabot's own behaviour. The queue drains by itself once the cause is fixed. Fix the cause on an agent-owned branch against `main`.

## Expected behaviour

Dependabot can propose current `devantler-tech/actions` revisions, and its pull requests can reach a mergeable state.

## Acceptance criteria

- [ ] The `🧹 Lint - mega-linter` failure has a readable root cause.
- [ ] That cause is fixed on an agent-owned branch against `main`.
- [ ] The open `dependabot/github_actions/*` count drops below the limit and a new PR is created.
- [ ] A proposal appears for a current `devantler-tech/actions` revision (v13.0.9 or later).

## Worth deciding along the way

Whether the default `open-pull-requests-limit: 5` is right here. It is a default rather than a decision, and it is what turned "one failing check" into "the whole ecosystem stops".

Rough size: small–medium, depending on what the linter is failing on.

Start with .github/dependabot.yaml and .github/workflows/validate-go-project.yaml, then inspect a current run of the injected Validate Go Project workflow or reproduce its lint check locally against one affected tree. Identify the readable root cause of the mega-linter failure and fix it on an agent-owned branch without modifying the automation-owned PRs. Done means the checks pass, the Dependabot queue drains below its limit, and a current actions revision is proposed.

Written by the indexing model from the issue text.