refactor(lockfile): consume external github/actions-lockfile module

[nodeselector]

Layer 4/7. Base: ns/release/pipeline.

Drop the vendored pkg/lockfile tree and depend on the standalone github.com/github/actions-lockfile/go module. Diagnostics now live under internal/lockfile/diagnostics. Note: pinned to a pseudo-version; bump to a real semver tag once actions-lockfile cuts one. Needs GOPRIVATE=github.com/github to fetch.

---

Part of a stacked series for the pre-release hardening of gh actions-pin. Review bottom-up; each PR is based on the one below it so the diff shows only that layer.

[Copilot]

⚠️ Not ready to approve

The refactor removes APIs still referenced elsewhere (breaking compilation) and includes a cross-platform persistence issue (Windows rename-overwrite) that should be addressed before approval.

Pull request overview

This PR refactors internal/lockfile to stop using the previously vendored lockfile implementation and instead consume the external github.com/github/actions-lockfile/go module, introducing a new on-disk lockfile state manager and deterministic YAML serialization.

Changes:

• Replace the old workflow/dependency parsing + diff helpers with a new State abstraction backed by the external actions-lockfile types.
• Add deterministic lockfile marshaling and direct-dependency tracking to support stable output and accurate “direct vs transitive” classification.
• Update module dependencies (go.mod / go.sum) to include github.com/github/actions-lockfile/go and refresh test dependencies.

File summaries

File	Description
internal/lockfile/state.go	New lockfile state implementation: load/normalize, set workflow deps, GC, and persist the lockfile.
internal/lockfile/state_marshal.go	Deterministic YAML writer (stable ordering + quoting) for byte-stable lockfile output.
internal/lockfile/state_test.go	New tests covering tag/branch persistence, determinism, GC behavior, and future-version refusal behavior.
internal/lockfile/direct_tracker.go	Tracks which resolved deps are workflow-direct across ref normalization/mutation.
internal/lockfile/convertor.go	Dependency ↔ pin conversion helpers for bridging internal dep types and external lockfile pins.
internal/lockfile/lockfile.go	Removed legacy workflow parsing/dependency writing implementation.
internal/lockfile/diff.go	Removed legacy dependency diff/preserve-ref helpers.
internal/lockfile/version.go	Removed legacy semver parsing helpers.
internal/lockfile/lockfile_test.go	Removed legacy tests tied to removed workflow parsing/writing code.
internal/lockfile/diff_test.go	Removed tests tied to removed diff helpers.
internal/lockfile/testdata/*	Removed test fixtures no longer used by the deleted internal/lockfile tests.
go.mod	Adds github.com/github/actions-lockfile/go (pseudo-version) and updates testify.
go.sum	Reflects module graph changes (adds actions-lockfile, updates testify, removes unused deps).

Copilot's findings

• Files reviewed: 16/17 changed files
• Comments generated: 3

Note

Your feedback helps us improve the quality of this feature.
Please use 👍 or 👎 to tell us whether this assessment is correct.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[nodeselector]

Consolidated into #30. Closing this stacked PR.