Switch in-repo action refs to $/ self-repository syntax once actionlint supports it

Context

zizmor 1.30's self-repository audit recommends GitHub's new self-repository syntax uses: $/... for in-repo actions (added July 2026). But actionlint currently rejects $/ as invalid ("specifying action … in invalid format because ref is missing"), so the two linters conflict and $/ isn't usable yet.

Current state (#154)

Kept zizmor unpinned (so we keep the latest audits) and suppressed only the self-repository audit inline with # zizmor: ignore[self-repository], leaving uses: ./... as-is. Applies to the 6 uses: ./.github/actions/setup-target steps in:

• auto-engineer.yml (×3)
• fix-dependabot-pr.yml
• investigate-security-alert.yml (×2)

Do this when unblocked

Once actionlint supports $/ (and GitHub runtime is confirmed to resolve it):

1. Convert uses: ./... → uses: $/... across the workflows.
2. Remove the # zizmor: ignore[self-repository] suppressions.

Refs: zizmor self-repository audit (https://docs.zizmor.sh/audits/#self-repository), #154, review on #151.

Check actionlint support for the $/ self-repository syntax and confirm that GitHub resolves it before starting. Then update the six uses: ./.github/actions/setup-target steps in auto-engineer.yml, fix-dependabot-pr.yml, and the two listed security/dependabot workflows, remove the zizmor suppressions, and run the workflow linters.