ci: run supply-chain-lint only on .github/ changes; re-sync vendored lint

[rafalry]

Summary

Follow-up to swan-bitcoin/actions#234, which makes supply-chain-lint scan the repository's own composite actions under .github/actions/ by default (PSEC-5231).

• Trigger only on .github/** changes. Everything the lint scans lives under .github/, so runs on unrelated PRs produced no signal.
• Refresh the header comment. The old text said the scanner never reaches .github/actions/; with actions#234 that is no longer true.
• The path filter applies to both the push and pull_request triggers; workflow_dispatch stays for manual runs.
• Re-sync the vendored action from swan-bitcoin/actions@b89206bcb5f662f9dffb57b8db8db0f1cdd2c403 (the actions#234 branch) so this public repo gets the same behavior. The lint always excludes its own directory, so the vendored copy does not flag itself. Note: once actions#234 merges (squash), the comment ref should be bumped to the resulting master commit on the next re-sync.

supply-chain-lint is not a required status check in this repo (checked the branch rulesets), so the paths filter cannot leave PRs stuck waiting on an expected check.

Verification

Ran the re-synced vendored copy against this branch exactly as CI would: Scanning 1 files... No supply chain violations found. (check-linear-link scanned; the lint's own directory self-excluded).

🤖 Generated with Claude Code

[laf-rge]

Approving supply-chain-lint workflow update.