security: pin remaining floating action tags and add Dependabot

[scttfrdmn]

Fixes #6.

The problem

8 of 8 uses: refs were still floating tags. A tag is mutable: @v5 means "whatever v5 points at when the job runs." actions/checkout@v6 genuinely moved (df4cb1c 2026-06-02 → d23441a 2026-07-16) with no signal to consumers, so this isn't hypothetical. Its composition-test.yml also lagged the other two workflows at checkout@v4 while they had already moved to v7.

Pinning and Dependabot are one control, not two. Shipping only one trades a live hole for a slow one.

Scope note, stated plainly: the exposure here is narrower than the suite's npm/PyPI publishers. The composition test runs against the Substrate AWS emulator — no real credentials, no instances, no cost. But release.yml holds contents: write to create the GitHub Release, so a compromised action in that job can write to this repo and alter published release artifacts.

The fix

1. Pinned the 8 floating refs to full commit SHAs with # vX.Y.Z comments, reusing the SHAs the already-pinned sibling adapters chose so the suite converges on one set rather than each repo picking its own.
2. .github/dependabot.yml covering github-actions and pip, weekly with a 7-day cooldown — a freshly published tag is exactly when a compromised or broken one is still unnoticed.
   • Group pattern is *, not actions/*: softprops/action-gh-release (which creates the Release under contents: write) isn't under actions/ and would otherwise fall outside the group — which is how bumps get quietly ignored.
   • ruff >=0.16 is explicitly ignored so a Dependabot bump can't undo the deliberate <0.16 cap in pyproject.toml.
   • No reviewers: key — deprecated and inert.
3. tests/test_ci_hygiene.py makes both halves regressions instead of conventions. Reverting a pin or dropping the Dependabot entry now fails pytest -q, which CI already runs. It asserts it found >0 refs, so a parser that stops matching fails rather than passing vacuously.

pyyaml joins the [dev] extra and is imported unguarded: a try/except ImportError degrades to a skip, and a skipped wiring test reports green while asserting nothing — the exact silent no-op these tests exist to catch.

Verification

• pytest tests/test_ci_hygiene.py — 3 passed
• ruff check . — clean
• grep -rhoE 'uses: [^ ]+' .github/workflows/ | grep -vE '@[0-9a-f]{40}$' — no output
• All workflow YAMLs still parse
• Mutation-tested 5 ways, each caught: unpin a ref; narrow the group pattern to actions/nope-*; remove the pip entry; delete dependabot.yml; drop a # vX.Y.Z comment. Both files verified byte-identical afterward, tests green again.

Honest note on local runs: pytest -q collects with pre-existing errors on my machine because the engine dependency isn't installed locally — identical error counts on unmodified main, so unrelated to this change. CI installs it via pip install -e ".[dev]".

No behaviour change — CI wiring and tests only. Part of the suite-wide sweep: libs#33/#36, spawn/truffle/lagotto/mcp, python-sdk#11, spawn-ts#73, truffle-ts#47, lagotto-ts#11, advisor-ts#7.