feat: sweep whuppi/ci refs to latest via upgrade-check

[chaudharydeepanshu]

What

Adds a whuppi-ci-refs job to the reusable upgrade-check.yml. It sweeps every whuppi/ci/…@vX.Y.Z ref across a consumer's .github — workflow files and vendored composite action.ymls — to the latest release, in one reviewed draft PR.

Why

Dependabot's github-actions updater never reads uses: refs inside composite action.yml (dependabot-core#6704, open). A grouped bump moves only the workflow-level refs and splits a consumer's pin, which the pin-availability gate then rejects (the failure seen on pdf_manipulator: whuppi/ci refs span multiple versions: v2.0.4 v2.0.5). This job owns the bump instead and keeps the pin uniform by construction.

Mirrors the existing flutter-sdk / lockfiles sweep pattern already in this workflow. Consumers drop whuppi/ci* from their Dependabot github-actions group once on this release.

Verification

• actionlint clean.
• Dry-ran the sweep against pdf_manipulator's 20 real refs → all resolve to a single v2.0.5, pin-availability passes; @main refs untouched.

MINOR — additive reusable-workflow job, no consumer action required for it to run.

[slopfairy]

Tip

Approved — both prior issues fixed, the new code is clean and correct

Both review threads from last round are addressed:

• mapfile replaced with the bash-3.2-portable while IFS= read -r array fill
• blanket git add .github replaced with targeted staging via the files multiline output — only the swept paths get staged

✅ Checked

• latest tag is validated against ^v[0-9]+\.[0-9]+\.[0-9]+$ before sed interpolation — solid injection guard
• sed -i.bak + # delimiter is portable across GNU/BSD sed
• process substitution < <(...) and += array append are both bash 3.2-compatible (macOS ships that bash)
• while read piped from printf in the commit step only runs git add as a side effect, no variable persistence needed across the subshell boundary
• actions/checkout pinned to full commit SHA; no untrusted github.event.* in run: blocks; permissions are contents: write + pull-requests: write — minimal
• @main refs are correctly left untouched (regex requires @v to match)
• no-op cases (no refs found / refs already current) handled cleanly with exit 0 guards
• CHANGELOG entry correctly bumps minor → 2.1.0 for the additive job
• UPDATING.md table + explanation are accurate
• PR title follows conventional commits: feat: sweep whuppi/ci refs to latest via upgrade-check

No new issues found.