Auto-sync version comments after Dependabot Actions bumps

When Dependabot updates a SHA pin on a uses: line that carries a
trailing `# zizmor: ignore[...]` comment, its comment-rewriter often
chokes and leaves the `# vX.Y.Z` version comment stale. zizmor's
ref-version-mismatch audit then turns red until the comment is fixed by
hand — see PR #70 for an example.

Add a workflow that fires on every push to dependabot/github_actions/**,
runs `zizmor --fix=safe .github/workflows`, and pushes a fixup commit
back to the dependabot branch when there's anything to fix. Modeled on
the `basecamp/fizzy` repo's `dependabot-sync-saas-lockfile.yml` pattern
(push trigger, contents: write, `git diff --cached --quiet` guard to
prevent loops). zizmor's CLI is installed via the prebuilt linux-x86_64
tarball at a pinned version since the official zizmorcore/zizmor-action
exposes only audit-shaped inputs and cannot apply fixes.

Author: jeremy

.github/workflows/dependabot-sync-actions-comments.yml

@@ -0,0 +1,40 @@
+name: Sync Action version comments
+
+on:
+  push:
+    branches: ["dependabot/github_actions/**"]
+    paths:
+      - ".github/workflows/*.yml"
+      - ".github/workflows/*.yaml"
+
+permissions: {}
+
+jobs:
+  sync:
+    name: Sync version comments
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 # zizmor: ignore[artipacked] -- credentials needed for git push
+
+      - name: Install zizmor
+        env:
+          ZIZMOR_VERSION: 1.24.1
+        run: |
+          curl -fsSL \
+            "https://github.com/zizmorcore/zizmor/releases/download/v${ZIZMOR_VERSION}/zizmor-x86_64-unknown-linux-gnu.tar.gz" \
+            | sudo tar xz -C /usr/local/bin
+
+      - name: Apply safe fixes (e.g. ref-version-mismatch)
+        run: zizmor --fix=safe .github/workflows
+
+      - name: Commit and push fixups
+        run: |
+          git add .github/workflows
+          if ! git diff --cached --quiet; then
+            git config user.name "github-actions[bot]"
+            git config user.email "github-actions[bot]@users.noreply.github.com"
+            git commit -m "Sync version comments after Dependabot Actions bump"
+            git push
+          fi