ci: one owner for every action ref — no workflow/composite split

[chaudharydeepanshu]

Evolves v2.3.0's composites-only sweep into a single owner for every action uses: ref. No split between Dependabot and a sweep.

What changes

• Renames composite-refs → action-refs.
• pinact widens from composites-only to all of .github (workflows + composites), --exclude '^whuppi/ci/'. One job pins every third-party action to SHA, wherever it lives — including the composite refs Dependabot can't read (#6704).
• whuppi/ci refs still swept uniform to the latest release (sed).
• Net: one PR for all action bumps; Dependabot is left owning only pub deps.

Consumer change (separate PR per repo)

Drop the whole github-actions ecosystem from dependabot.yml (not just whuppi/ci*), keep sweepActions: true + CI_ACTIONS_TOKEN.

Verified

• actionlint + zizmor (auditor): clean.
• pinact --update --exclude '^whuppi/ci/' over workflows+composites proven against pdf: bumps actions/checkout in workflows AND actions/cache in composites, leaves whuppi/ci refs as tags.

Cut as v2.4.0 on merge.

[slopfairy]

Tip

Approved — clean rename and scope-widen, no security or correctness regressions

🟡 Suggestions — optional, take it or leave it

1. tool/versions.env:38-41 — The comment still says "inside composite action.yml" and "composite-refs sweep". Update it to "workflows AND composites" and "action-refs job" to match the new scope.
2. tool/ci/upgrade.sh:210 — Comment still says "(composite-refs sweep in upgrade-check.yml)". Update to "(action-refs job in upgrade-check.yml)".

✅ Checked

• No pull_request_target; the workflow is workflow_call, safe from fork attacks
• $latest in the sweep step validated against ^v[0-9]+\.[0-9]+\.[0-9]+$ before sed interpolation
• pinact installed at a pinned version from versions.env — no floating tool risk
• --exclude '^whuppi/ci/' correctly keeps whuppi/ci refs as version tags while pinning third-party ones
• GITHUB_TOKEN in the pinact step is github.token (contents:read); all writes go through the opt-in CI_ACTIONS_TOKEN PAT
• set -euo pipefail present in both the sweep and pinact steps
• find targets are local filesystem paths, not interpolated from untrusted input
• git diff --name-only staging matches the widened scope (workflows + actions)
• Branch name (chore/action-refs) and label (upgrade-action-refs) are hardcoded, never interpolated
• Job permissions at contents: read — minimal and correct
• Release stamping (release_stamp_tree hook) covers .github/workflows/*.yml, so the renamed job stamps correctly
• internal-refs-are-main guard in self-check.yml covers .github/workflows/ correctly
• Changelog and UPDATING.md accurately describe the change and consumer migration