fix: import Twilio Dependabot files

## Summary

Import the two Dependabot files that [`tfroot-twilio` PR
#1](makeitworkcloud/tfroot-twilio#1) seeded
through the required pull-request path. This lets their canonical
`tfroot-github` resources adopt existing files instead of attempting
protected direct creation.

The import reports inherited commit metadata and a create-only setting
that would otherwise cause a protected-branch file update. The two
resource definitions therefore ignore only `commit_message` and
`overwrite_on_create`; their centrally managed file content remains
enforced.

Fixes # N/A — repair the failed central Dependabot adoption path.

## Type of change

- [x] Bug fix
- [ ] Feature / enhancement
- [ ] Documentation
- [x] Infrastructure (OpenTofu root or module)
- [ ] GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS
secrets)
- [ ] Container image
- [ ] CI / reusable workflow
- [ ] Refactor / cleanup
- [ ] Breaking change

## Validation

- [x] Required pull-request checks pass — OpenTofu test and plan
succeeded in [run
33819976668](https://github.com/makeitworkcloud/tfroot-github/actions/runs/33819976668).
- [x] Plan is exactly `2 to import, 0 to add, 0 to change, 0 to
destroy`.
- [x] Generated or centrally distributed files were regenerated by their
owning automation, not hand-edited — the files were exact PR seeds and
retain `tfroot-github` as their canonical owner.

The provider's documented import IDs use `repository:file-path:branch`,
with an empty branch for the default branch. No local OpenTofu, SOPS,
state, import, plan, or apply operations were run.

## Impact and rollout

Producer: `tfroot-github` owns both generated files and their resource
state. Consumer: `tfroot-twilio` now contains the exact seeded files on
`main` at
[`315acbf8`](makeitworkcloud/tfroot-twilio@315acbf).

The previous main apply attempted direct creation before the files
existed and failed on repository protection. This PR imports only
`.github/dependabot.yml` and `.github/workflows/dependabot-notify.yml`
into their existing central resources. Its validated plan neither writes
a file nor changes repository protection, Actions secrets, Twilio
configuration, or any GitOps/runtime system. After a confirmed merge,
verify the environment-gated apply succeeds and records the two imports.

Rollback is a reviewed revert of these import declarations. Do not
manually edit the managed target files.

## Safety and secrets

- [x] Contains no plaintext secrets, decrypted SOPS values, state files,
kubeconfigs, tokens, or private endpoints.
- [x] No local OpenTofu init/plan/apply/destroy/import/state operations
were run or claimed — plans come from pull-request checks.
- [x] Breaking or irreversible effects are described above with rollback
notes.

Repository-side secret scanning is unavailable because GitHub Advanced
Security is not enabled; the diff was manually inspected before
publication.

AI agent materially produced this change; reviewers should confirm the
documented import IDs, exact resource addresses, metadata-only lifecycle
exclusions, and retained central ownership.

Author: xnoto

gh-dependabot.tf

@@ -70,6 +70,16 @@ resource "github_repository_file" "dependabot" {
   content             = "# Managed by tfroot-github (gh-dependabot.tf); local edits are overwritten.\n${yamlencode(each.value)}"
   commit_message      = "chore: sync managed dependabot configuration"
   overwrite_on_create = true
+
+  # These attributes are creation/commit metadata, not the centrally managed
+  # file content. Ignoring imported values avoids a protected-branch write when
+  # adopting a PR-seeded file; future content changes remain managed.
+  lifecycle {
+    ignore_changes = [
+      commit_message,
+      overwrite_on_create,
+    ]
+  }
 }
 
 locals {
@@ -106,4 +116,13 @@ resource "github_repository_file" "dependabot_notify" {
   content             = local.dependabot_notify_workflow
   commit_message      = "chore: sync managed dependabot notification workflow"
   overwrite_on_create = true
+
+  # See github_repository_file.dependabot above. The workflow content remains
+  # managed; only imported creation/commit metadata is ignored.
+  lifecycle {
+    ignore_changes = [
+      commit_message,
+      overwrite_on_create,
+    ]
+  }
 }

imports.tf

@@ -7,3 +7,16 @@ import {
   to = github_repository.repositories["channel-project"]
   id = "channel-project"
 }
+
+# These files were seeded through tfroot-twilio PR #1 because its temporary
+# protection rejects direct file creation. Import them before central management
+# so the first reconciled apply does not attempt another protected direct write.
+import {
+  to = github_repository_file.dependabot["tfroot-twilio"]
+  id = "tfroot-twilio:.github/dependabot.yml:"
+}
+
+import {
+  to = github_repository_file.dependabot_notify["tfroot-twilio"]
+  id = "tfroot-twilio:.github/workflows/dependabot-notify.yml:"
+}