chore(ci): bump k9/a2ml validate-action pins to current main (#4)

The pinned SHAs carried two fixed false-positives:
- k9-validate-action: pedigree brace-counting bug ('missing name'
  on files with a security block before metadata) - fixed in #7.
- a2ml-validate-action: identity-field check on canonical typed /
  *file.a2ml manifests - fixed in #8/#9.

Also adds github-actions to dependabot so action pins stay current.

Co-authored-by: Jonathan D.A. Jewell <67598845+hyperpolymath@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: 3 people

.github/workflows/dogfood-gate.yml

@@ -38,7 +38,7 @@ jobs:
 
       - name: Validate A2ML manifests
         if: steps.detect.outputs.count > 0
-        uses: hyperpolymath/a2ml-validate-action@b2f28c39491c0d1ff131b8fb9e197bfea79e411e # main
+        uses: hyperpolymath/a2ml-validate-action@86c6da6d2e9c8c07adaff2737ca7d4b5f7d793af # main
         with:
           path: '.'
           strict: 'false'
@@ -86,7 +86,7 @@ jobs:
 
       - name: Validate K9 contracts
         if: steps.detect.outputs.k9_count > 0
-        uses: hyperpolymath/k9-validate-action@f985acb62d1ed46a4b3434dc6cb148dad95cf62d # main
+        uses: hyperpolymath/k9-validate-action@cfa7f92f6bed88e706a481f7f520e4580d7b9599 # main
         with:
           path: '.'
           strict: 'false'