Make Dependabot update organization workflow templates directly #56

Context

GitHub Dependabot supports scanning workflow-templates/ directly for the github-actions ecosystem. Nextcloud itself uses this model.

The current architecture can allow dependency pins to drift between vendored upstream, patches, rendered output and the organization catalog.

Goal

Configure dependency updates at the actual organization template source and define how those updates coexist with upstream rendering.

Requirements

• Add a github-actions Dependabot entry for /workflow-templates.
• Keep ordinary Action dependency updates from being overwritten by a later upstream render.
• Review existing organization patches that modify uses: pins and remove unnecessary version-only patching.
• Define which layer is authoritative for LibreCode-specific Action pins.
• Add regression checks for stale/duplicated Action references where needed.
• Avoid custom dependency-index/resolver machinery unless a concrete limitation is demonstrated.

Done when

Action dependency updates can be proposed and merged in this repository without creating drift that a subsequent upstream refresh silently reverts.