fix(ci): contain Dependabot PRs per fleet policy v0.1

[hummbl-dev]

Summary

• Add if: github.actor != 'dependabot[bot]' guard to schema-validation job so Dependabot PRs skip standard CI
• Add dependabot-verify.yml workflow for path/provenance verification on self-hosted runners only
• Resolves [Commit Delta][P0] Neutralize GitHub-hosted schema validation #11 (P0: neutralize GitHub-hosted schema validation)

Policy

Fleet Dependabot CI Containment Policy v0.1 — Dependabot PRs skip standard CI, verify on self-hosted only.

Test plan

• Dependabot PR triggers dependabot-verify.yml (not schema-validation.yml)
• Regular PR triggers schema-validation.yml normally

Generated with Devin

[hummbl-dev]

CHANGES_REQUIRED — major policy/enforcement defects at 427314a.

CodeRabbit raised 4 issues; all four are valid:

1. .github/workflows/dependabot-verify.yml:61-78: ALLOWED_PATTERNS is a quoted, indented multiline string. Bash preserves the leading spaces, and the loop does not trim them, so ordinary paths such as package.json do not match. Every legitimate Dependabot PR will be reported as changing forbidden paths. Use a Bash array (or trim each line) and add positive/negative fixture coverage for the actual shell logic.
2. Lines 24-29 select generic [self-hosted, Linux, X64] runners, contradicting the file's claim that this does not run on persistent self-hosted runners with full CI state. Target an admitted Dependabot-only runner group/label.
3. timeout-minutes: 2 does not make a missing-runner job neutral; it applies after a runner starts. Provide an external/always-available status mechanism or accurately fail closed as pending instead of claiming neutral/skip-if-no-runner behavior.
4. The checkout step uses mutable actions/checkout@v7; pin the reviewed full commit SHA, consistent with this repository's existing workflow.

Independent governance finding: main currently has one required approval but no required status checks and no repository rulesets, and this repository has no auto-merge workflow. Therefore Dependabot Verify is advisory, not a merge gate, despite the PR's “verify on self-hosted only” policy claim. Add/enforce the required check (or an equivalent admitted merge gate) before resolving the P0 issue.

The PR's own Dependabot Verify run is SKIPPED because the author is not Dependabot, so none of this new path has been exercised. Local checks passed for YAML parsing, all positive schema fixtures, all invalid fixtures, and git diff --check; those do not cover the defects above.