fix(ci): converge Dependabot catalogs without pushing workflow files

[rldyourmnd]

Summary

Owner policy D01: ordinary merge/deploy in this repository does not wait on a required general CI context. Source ruleset 21104086 desired state and .gds/repository.yaml required_contexts no longer name ci-gate. The ci-gate job still runs (core, touched, actionlint, zizmor, negative gates) as truthful advisory evidence. Consumer reusable gates stay selectable (examples/quality/caller-native-gate.yml).

Dependabot catalog convergence still cannot push workflow files. Catalog-only now follows the unique workflow pin per action and fails closed on mixed identities, so the catalog cannot describe a pin the tree does not share.

Does not close #93/#94 from this SHA. Does not claim #86/#87 downstream adoption. Does not merge Dependabot PR #92. Does not apply live GitHub settings.

Type of change

• Fix to an existing workflow
• Hardening / security posture improvement
• Docs only

Threat-model note

dependabot-catalog-convergence.yml still uses a trusted default-branch checkout and treats the Dependabot branch as data. It still does not push workflow-file updates. Permissions unchanged. No workflows permission is requested. ci-gate remains in ci.yml as an aggregate; it is no longer a required merge context in the authored ruleset.

Permissions diff

None.

Live settings diff (read-only; coordinator plan→approve→apply)

Ruleset 21104086 Protect main (signed commits), enforcement active. Snapshot /tmp/gds2-live-21104086.json. Desired /tmp/gds2-live-21104086-desired.json.

Field	Source .github/rulesets/branch-main.json	Live 21104086	Proposed apply
required_status_checks	absent	ci-gate strict	remove the rule (do not leave [])
allowed_merge_methods	["merge"]	merge+squash+rebase	set live to ["merge"]
deletion / non_fast_forward / required_signatures	present	present	keep
pull_request reviews / thread resolution / extra approval unattributed	0 / true / true	0 / true / true	keep
workflows permission	not requested	n/a	do not add

Advisory anchor-contexts fails on this SHA until that apply: live still requires ci-gate.

Checklist

• Pins/permissions/concurrency unchanged except catalog-only unique-pin fail-closed
• actionlint OK
• zizmor@1.26.1 --persona pedantic on changed workflows: no findings
• CHANGELOG [Unreleased]
• Signed DCO commits rldyourmnd <danil@nddev.it.com>

Verification

Base f7e4aa8da159c6803082eb3fd6e1bf78624c76d7. Head 1532ced8646e5f38d27d57513efe13a5f20701b4.

.venv/bin/python -I -B scripts/check_python_execution_contract.py --launch \
  validate_all.py -- --tier touched --changed-from f7e4aa8da159c6803082eb3fd6e1bf78624c76d7
# validate_all (touched): OK

.venv/bin/python -I -B scripts/check_python_execution_contract.py --launch \
  validate_all.py -- --tier core
# validate_all (core): OK

GH_TOKEN=… .venv/bin/python -I -B scripts/check_python_execution_contract.py --launch \
  validate_all.py -- --changed-from f7e4aa8da159c6803082eb3fd6e1bf78624c76d7
# validate_all (all): FAIL only advisory anchor-contexts (live ci-gate vs empty source)

PR92 isolation (SHA 11bf5e48, not GitHub runtime): unique pins 43/43; catalog-only updated catalog only; mixed-pin negative failed closed.

Issues in scope

• [CI feedback] workflow 335161293: run 34091813231/1 #94 OPEN: original Dependabot ci failure stays failure.
• [CI feedback] workflow 341408090: run 34091935173/1 #93: original convergence workflow-push failure stays failure; coordinator owns auto-close disposition.
• chore(deps): bump the github-actions group with 11 updates #92 OPEN Dependabot bump: not merged here.