Normalize CI/CD workflows

[schmidtw]

Workflow Gaps

The following CI/CD workflows do not match the xmidt-org Ideal State.

Missing or misconfigured workflows

• ci.yml — missing top-level permissions: block (needs pull-requests: read, contents: write, packages: write)
• auto-releaser.yml — workflow file does not exist
• approve-dependabot.yml — file named dependabot-approver.yml instead of approve-dependabot.yml
• dependabot-approver.yml — uses wrong reference: xmidt-org/.github/.github/workflows/dependabot-approver-template.yml@main instead of xmidt-org/shared-go/.github/workflows/approve-dependabot.yml
• proj-xmidt-team.yml — uses wrong reference: xmidt-org/.github/.github/workflows/proj-template.yml@proj-v1 instead of xmidt-org/shared-go/.github/workflows/proj-xmidt-team.yml
• proj-xmidt-team.yml — missing top-level permissions: block (needs contents: read, issues: write, pull-requests: write)

Unpinned actions

• dependabot-approver.yml:15 — uses: xmidt-org/.github/.github/workflows/dependabot-approver-template.yml@main — must pin to full commit SHA with version comment
• proj-xmidt-team.yml:17 — uses: xmidt-org/.github/.github/workflows/proj-template.yml@proj-v1 — must pin to full commit SHA with version comment

Reference

• Reference repos: xmidt-org/wrpssp, xmidt-org/wrp-go