Workflow actions are pinned by commit SHA, which the repository now enforces,
so nothing updates them without Dependabot. One grouped pull request per month
keeps the pins current without a PR per action, and the `ci` commit prefix
satisfies the `pr-title` check.

Documentation impact: the delivery section records the repository rules that
changed alongside this file - squash-only merges, automatic branch deletion,
auto-merge, the `v*` tag ruleset, and required SHA pinning - so the guide keeps
matching the effective settings.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>