Dependabot cannot update the .github/ci/actions.toml pin registry: every actions major needs a manual sync commit

Four consecutive GitHub-Actions majors (#3549 setup-node, #3598 checkout, #3599 setup-python, #3633 setup-dotnet) failed `Check generated workflows` + `inline-script-tests` the same way: dependabot bumps the pins in the generated `.github/workflows/policy-engine-ci.yml` but cannot edit the `.github/ci/actions.toml` source of truth, so the generated file drifts from its manifest and a maintainer has to push `actions.toml` + `generate_workflows.py --write` on every such PR.

Options:

1. Exclude `policy-engine-ci.yml` from dependabot's watched files (dependabot supports neither per-file excludes nor generated-file awareness directly, but moving the generated workflow out of `.github/workflows/` naming that dependabot rewrites is not possible; alternatively list the pinned actions in `ignore:` for that directory and rely on the registry as the single source).
2. A small workflow on `pull_request` for dependabot actions PRs that detects the drift and auto-commits the registry sync + regeneration (same shape as the manual fix, automated).
3. Teach `generate_workflows.py --write` to run the OTHER direction on dependabot branches: read the bumped pin out of the generated file and update the registry.

Any of these removes a recurring manual step. Evidence and the exact per-PR fix are in the four PRs' review threads.

Start with .github/ci/actions.toml, generate_workflows.py, and the generated .github/workflows/policy-engine-ci.yml; review the exact fixes and discussion in PRs #3549, #3598, #3599, and #3633. Compare the three proposed approaches and verify the chosen automation handles Dependabot pin updates without registry drift, while Check generated workflows and inline-script-tests pass.

Written by the indexing model from the issue text.