catalog: add scenarios for branch-ref narrowing and local-path-only workflows

New scenarios:
- fresh_branch_ref_narrows: @main on public action narrows to full semver
- fresh_branch_ref_no_narrow: --no-narrow keeps @main as-is
- onboarded_branch_ref_narrows: verified dep at @main gets narrowed on repin
- local_action_only: workflow with only local path steps, no remote refs

Replaces the now-wrong fresh_branch_ref_skipped which asserted @main
stayed as main (before non-semver narrowing was added).

Author: nodeselector

test/integration/run.rb

@@ -373,6 +373,26 @@ def golden_json_diff(expected, actual, path)
       }
     )
   },
+  # Lockfile with a branch-ref dep key (main) — represents a workflow
+  # onboarded with --no-narrow that should be narrowed on re-pin.
+  "pinned_checkout_main" => -> {
+    build_lockfile(
+      workflows: {
+        ".github/workflows/ci.yml" => [
+          "actions/checkout@main:sha1-#{CHECKOUT_SHA}"
+        ]
+      },
+      dependencies: {
+        "actions/checkout@main:sha1-#{CHECKOUT_SHA}" => {
+          "tag" => "",
+          "branch" => "main",
+          "commit" => "sha1-#{CHECKOUT_SHA}",
+          "owner_id" => 44036562,
+          "repo_id" => 197814629
+        }
+      }
+    )
+  },
   "future_version" => -> {
     <<~YAML
       # This file is machine-generated by `gh actions-lock`.

test/scenarios/catalog.yml

@@ -652,10 +652,24 @@ scenarios:
       exit: 0
       lockfile_comment_matches: 'v4\.2\.0'
 
-  - name: fresh_branch_ref_skipped
+  - name: fresh_branch_ref_narrows
     category: narrowing
-    description: "Branch ref (main) is not a semver — narrowing skips it"
+    description: "Branch ref (main) on public action narrows to full semver"
     needs_token: true
+    fixtures:
+      workflows:
+        ci.yml:
+          name: CI
+          actions: ["actions/checkout@main"]
+    expect:
+      exit: 0
+      lockfile_comment_matches: 'v\d+\.\d+\.\d+'
+
+  - name: fresh_branch_ref_no_narrow
+    category: narrowing
+    description: "--no-narrow: branch ref (main) stays as main"
+    needs_token: true
+    flags: ["--no-narrow"]
     fixtures:
       workflows:
         ci.yml:
@@ -665,6 +679,39 @@ scenarios:
       exit: 0
       lockfile_comment_matches: 'main'
 
+  - name: onboarded_branch_ref_narrows
+    category: narrowing
+    description: "Onboarded workflow at @main — verified dep narrowing upgrades to full semver"
+    needs_token: true
+    fixtures:
+      workflows:
+        ci.yml:
+          name: CI
+          actions: ["actions/checkout@main"]
+      lockfile_template: pinned_checkout_main
+    expect:
+      exit: 0
+      lockfile_comment_matches: 'v\d+\.\d+\.\d+'
+
+  - name: local_action_only
+    category: workflow_parsing
+    description: "Workflow with only local path actions (no remote refs) — skipped cleanly"
+    needs_token: true
+    fixtures:
+      workflows:
+        ci.yml:
+          raw: |
+            name: CI
+            on: push
+            jobs:
+              build:
+                runs-on: ubuntu-latest
+                steps:
+                  - uses: ./.github/actions/my-action
+                  - uses: ./.github/actions/other-action
+    expect:
+      exit: 0
+
   - name: fresh_no_narrow_keeps_major
     category: narrowing
     description: "--no-narrow: splat ref v4 stays v4 in lockfile (not narrowed to v4.x.y)"