feat: automate cilock-action rebuild on rookery releases

[colek42]

Problem

cilock-action depends on rookery modules via replace directives pointing to ../rookery. When rookery cuts a new release, cilock-action must:

1. Update go.mod replace directives to point at the tagged version (or keep local for monorepo dev)
2. Rebuild binaries against the new rookery
3. Cut its own release

This is currently manual.

Proposed solution

Add a GitHub Actions workflow to cilock-action that triggers on rookery releases:

on:
  repository_dispatch:
    types: [rookery-release]
  workflow_dispatch:
    inputs:
      rookery_version:
        description: 'Rookery version to build against'
        required: true

Rookery side

Add a step to the rookery release workflow that dispatches to cilock-action:

- name: Trigger cilock-action rebuild
  uses: peter-evans/repository-dispatch@v3
  with:
    token: ${{ secrets.CILOCK_ACTION_PAT }}
    repository: aflock-ai/cilock-action
    event-type: rookery-release
    client-payload: '{"version": "${{ steps.version.outputs.version }}"}'

cilock-action side

The triggered workflow:

1. Checks out cilock-action + rookery at the specified tag
2. Runs tests
3. Creates a PR bumping the rookery dependency version
4. Auto-merges if CI passes
5. Tags and releases cilock-action with matching version

Acceptance criteria

• Rookery release triggers cilock-action rebuild automatically
• cilock-action release references the exact rookery version it was built against
• Manual trigger available via workflow_dispatch for ad-hoc builds
• Release notes link back to the rookery release