fix: migrate ci_dependencies to org-infra reusable workflows

[yvonnedevlinrh]

Summary

.github/workflows/ci_dependencies.yml ran actions/dependency-review-action as an inline step, which hard-failed on every PR to main because the Dependency Graph / GitHub Advanced Security is not enabled on this repo. This migrates the workflow to the org-standard complytime/org-infra reusable-caller pattern (matching ci_security.yml / ci_scheduled.yml), soft-gating dependency review so it no longer blocks PRs, and adds a github-actions Dependabot config.

• Replace the inline dependency-review job with call_deps_reviewer (General) and call_dependabot_reviewer (Dependabot), pinned to complytime/org-infra@0c784711…926c9864f027ec565fd7c06a382d80f8 # v0.7.1 — the same SHA already used by the security workflows.
• Dependency review is now soft-gated (continue-on-error: true, applied inside the reusable), resolving the hard-fail.
• Deliberately excludes the Dependabot auto-approve / comment jobs from the canonical org pattern: this repo governs org policy (Peribolos, safe-settings, rulesets), so auto-approving Dependabot PRs here is an elevated attack surface, deferred pending a separate threat-model review.
• Add .github/dependabot.yml for the github-actions ecosystem only (weekly); go.mod is intentionally out of scope.
• Includes the OpenSpec change fix-ci-dependencies-reusable-migration (proposal, spec, design, tasks).

Related Issues

• Closes chore: replace inline dependency-review-action with org-infra reusable workflows #41

Review Hints

• How to test: After merge, open any PR to main and confirm the Dependency Review check runs without hard-failing (the General caller job). Locally: yamllint .github/workflows/ci_dependencies.yml .github/dependabot.yml and make lint both pass.
• The call_dependabot_reviewer job's inner logic is gated on github.event.pull_request.user.login == 'dependabot[bot]', so it won't do meaningful work on a human-authored PR — verify by inspecting the reusable rather than expecting it to run on this PR.
• Key files: .github/workflows/ci_dependencies.yml (inline → reusable callers), .github/dependabot.yml (new), openspec/changes/fix-ci-dependencies-reusable-migration/* (planning artifacts).
• Mirrors the already-merged pattern in ci_security.yml; same adoption is tracked for unbound-force/replicator#38.

This PR was generated by /uf.finale (AI-assisted).

[yvonnedevlinrh]

CI failures here are inherited from main, not caused by this PR

The two red checks on this PR — OSV-Scanner and OpenSSF Scorecards — do not come from this change. They originate from ci_security.yml, which this PR does not touch (this PR only modifies ci_dependencies.yml and adds dependabot.yml).

Both fail with dead action SHAs that no longer resolve on GitHub:

##[error]Unable to resolve action `google/osv-scanner-action@e5012758…`, unable to find version
##[error]Unable to resolve action `ossf/scorecard-action@05b42c62…`, unable to find version

Because this branch was cut from main — which still has the broken ci_security.yml — it inherits those failures.

This PR's own change is passing ✅

• General / Dependencies Review → pass (the new reusable_deps_reviewer.yml caller works; the previous inline dependency-review-action hard-fail is resolved)
• Dependabot / Dependabot Review → skipping (correct — the inner job is gated on a Dependabot author)
• Lint, Test, Apply-peribolos, Verify peribolos → pass

Fix + merge order

The OSV/Scorecard failures are fixed by #43 (ci: migrate ci_security and ci_scheduled to org-infra reusable workflows).

1. Merge ci: migrate ci_security and ci_scheduled to org-infra reusable workflows #43 first — it replaces the dead-SHA security workflows on main.
2. Rebase/update this PR (fix: migrate ci_dependencies to org-infra reusable workflows #44) on the new main.
3. The OSV-Scanner and OpenSSF Scorecards checks will then clear, since fix: migrate ci_dependencies to org-infra reusable workflows #44 will inherit the fixed ci_security.yml.

Minor note: #43 and #44 both add openspec/config.yaml (identical 1-line scaffold), so a trivial conflict on that file is possible when rebasing — if so, it resolves to the same content.

[marcusburghardt]

LGTM