Normalize CI/CD workflows

Workflow Gaps

The following CI/CD workflows do not match the xmidt-org Ideal State.

Missing or misconfigured workflows

• ci.yml — missing top-level permissions: block (needs pull-requests: read, contents: write, packages: write)
• auto-releaser.yml — file does not exist (required for automated releases)
• approve-dependabot.yml — file is named dependabot-approver.yml instead, and references wrong shared workflow (uses xmidt-org/.github/.github/workflows/dependabot-approver-template.yml@main instead of xmidt-org/shared-go/.github/workflows/approve-dependabot.yml)
• proj-xmidt-team.yml — references wrong shared workflow (uses xmidt-org/.github/.github/workflows/proj-template.yml@proj-v1 instead of xmidt-org/shared-go/.github/workflows/proj-xmidt-team.yml)
• proj-xmidt-team.yml — missing top-level permissions: block (needs contents: read, issues: write, pull-requests: write)

Unpinned actions

• proj-xmidt-team.yml:16 — uses: xmidt-org/.github/.github/workflows/proj-template.yml@proj-v1 — must pin to full commit SHA with version comment
• dependabot-approver.yml:14 — uses: xmidt-org/.github/.github/workflows/dependabot-approver-template.yml@main — must pin to full commit SHA with version comment

Reference

• Reference repos: xmidt-org/wrpssp, xmidt-org/wrp-go

Start by inspecting .github/workflows/ci.yml, dependabot-approver.yml, and proj-xmidt-team.yml, then compare them with the workflow setup in xmidt-org/wrpssp and xmidt-org/wrp-go. Add the missing auto-releaser.yml, correct filenames and shared workflow references, add the specified permissions, and pin the listed actions to full commit SHAs with version comments; completion means every checklist item is satisfied.