chore: apply review fixes

[jwmoss]

• test.yml: set persist-credentials: false on all five actions/checkout steps.
• issue-comment-triage.yml: move github.event.issue.html_url to an ISSUE_URL env var and reference $COMMAND/$ISSUE_URL in the shell step. Add permissions: issues: write, pull-requests: write.
• lock.yml: add permissions: issues: write, pull-requests: write.
• goreleaser-check.yml: set cache: false on actions/setup-go.
• internal/provider/client.go: isNotFound uses errors.As instead of a type assertion so wrapped *apiError values match.
• dependabot.yml: add cooldown: default-days: 7 to every entry, switch both gomod entries to weekly, and group all gomod updates with patterns: ["*"].

Checks: go build, go vet, go test -short, golangci-lint run, actionlint, and zizmor (0 findings) pass.