chore: update Github Actions and switch to SHA pinning over tags

[jtroup]

what

Updated GitHub Actions, pre-commit hooks, and added automation tooling:

• Upgraded GitHub Actions in CI and release workflows:
  • actions/checkout: v5.0.0 → v6.0.0
  • actions/setup-python: v6.0.0 → v6.1.0
  • astral-sh/setup-uv: v7.1.3 → v7.1.4
  • pypa/gh-action-pypi-publish: changed from branch reference (release/v1) to SHA-pinned v1.13.0
• Updated pre-commit hooks:
  • ruff: v0.14.2 → v0.14.7
  • uv-pre-commit: 0.9.5 → 0.9.13
  • Added actionlint hook (v1.7.9) for GitHub Actions workflow validation
• Added .github/dependabot.yaml to enable automated monthly dependency updates for GitHub Actions

why

• Security & Stability: Keep actions and tools up-to-date with latest bug fixes and security patches
• Automation: Dependabot will automatically create PRs for future GitHub Actions updates, reducing manual maintenance burden
• Quality: The actionlint hook validates GitHub Actions workflow syntax and catches common mistakes during pre-commit
• Consistency: Pinning gh-action-pypi-publish to a specific version (v1.13.0) instead of a branch reference ensures reproducible releases

testing

just lint and landing this PR.

docs

N/A

---

🤖 Generated with Claude Code