ci: self-heal action-pin drift on cascade's own repo

[joshua-temple]

Problem

When an external bump changes a governed action pin in one of cascade's own generated workflows, the pins drift from the manifest and a maintainer had to reconcile by hand.

Fix

Deploys the reconcile command as cascade's own self-heal:

• Adds a read-only cascade reconcile --check detector to the PR-validation workflow that uploads a pin-reconcile-result artifact (advisory, never fails the gate, fork-safe).
• Adds pin-reconcile.yaml, a workflow_run companion that runs when the detector reports a governed pin changed. It resolves the PR from workflow_run metadata only, fetches a pinned released binary, runs cascade reconcile --own-repo over the head files as data, and pushes the regenerate commit to the PR head branch.

Safety: the default token stays read-only and the single write path uses the trigger-capable state token; head files are read as data and never executed; the emitted bot commit is DCO signed-off; fork PRs are skipped; and the push is guarded by a staged-diff check plus a fresh-tip non-fast-forward abort.

Verification

• actionlint clean on both workflows.
• Independent security review passed (no head-code execution, correct token scope, injection-safe, fork-safe, loop-terminating).
• The companion becomes active once a release carrying reconcile is published; end-to-end validation follows that release.

Closes #438. Part of #440.