feat(automation): govern Classic dependency updater identity

[zoeyrose]

Summary

• record the organization-owned Classic dependency updater App, installation, exact permissions, intended consumer, lifecycle ownership, and value-free Actions metadata names;
• extend manual-settings validation and live verification to fail closed on App identity, permission, event, selection-mode, suspension, repository, pagination, secret-name, or variable-name drift;
• document token lifetime, Classic-only owner verification, stable branch and one-PR boundaries, non-cancelling concurrency, duplicate handling, key rotation, incident response, revocation, and downstream functional proof.

Live state reconciled

• App: atrinik-classic-dependency-updater (4564008)
• Installation: 153045686, organization-owned, selected mode, unsuspended, no webhook events
• Exact permissions: metadata read, contents write, pull requests write
• Repository: only atrinik/classic (1327289971), confirmed through the organization-owner installation UI
• Classic Actions metadata names: DEPENDENCY_UPDATE_APP_ID and DEPENDENCY_UPDATE_APP_PRIVATE_KEY
• Organization defaults preserved: workflow permission read; Actions PR-review approval disabled

The GitHub permission model couples branch/ref/release operations under contents: write and PR mutation/review operations under pull requests: write. The runbook documents that limitation explicitly and makes every non-branch/PR operation a consumer-contract violation and incident instead of claiming the credential is technically release- or review-incapable.

Validation

• bin/validate
• shellcheck bin/* tests/*.sh
• for test in tests/*.sh; do "${test}"; done
• bin/verify-manual-settings against live metadata
• bin/publish in plan mode only
• git diff --check origin/main...HEAD

All passed at 96f037333b5c17814b3c5a7853d93742ab5a5906. The aggregate rerun includes the project-health and planning-health fixtures aligned to the App record's truthful August 11 verification date, plus a leap-day fixture that advances both governed credential lifecycles coherently. No publisher apply was run and no credential value was read or logged.

Ordered rollout

Part of #63 and atrinik/atrinik#356. This PR intentionally does not close #63. After human review and merge, atrinik/classic#169 owns the pinned consumer workflow and its root supply-chain inventory update. The issue remains open until a manually dispatched App-authored disposable PR triggers the ordinary Classic checks, cannot satisfy its own human approval or merge gate, and is safely closed with its branch removed.

[github-actions]

🎉 This PR is included in version 1.9.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀