ci: auto-refresh website GitHub activity 3x daily

Adds a GitHub Actions cron workflow that fetches the latest releases
and commits from the GitHub API and commits the updated
github-activity.json to the repo.

Schedule: 3x daily (00:00, 08:00, 16:00 UTC).
Also runnable manually via workflow_dispatch.

Only commits when the data actually changed (git diff check), so
empty runs produce no noise. Uses [skip ci] to avoid triggering the
full test suite on data-only commits.

Author: a19q3

.github/workflows/website-data-refresh.yml

@@ -0,0 +1,56 @@
+name: Website Data Refresh
+
+# Refreshes the build-time data (GitHub releases, commits, provenance,
+# pipeline fragments) that the website sidebar and sections display.
+# Runs 3x daily so the sidebar always shows recent activity without
+# anyone manually running the scripts.
+
+on:
+  schedule:
+    # 3x daily: 00:00, 08:00, 16:00 UTC
+    - cron: "0 0,8,16 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+concurrency:
+  group: website-data-refresh
+  cancel-in-progress: true
+
+jobs:
+  refresh:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Fetch GitHub activity data
+        run: python3 website/scripts/fetch-github-data.py
+
+      - name: Check for changes
+        id: changes
+        run: |
+          if git diff --quiet website/src/data/github-activity.json; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Commit refreshed data
+        if: steps.changes.outputs.changed == 'true'
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add website/src/data/github-activity.json
+          git commit -m "chore(website): refresh GitHub activity data [skip ci]
+
+          Auto-generated by website-data-refresh workflow.
+          Fetched: $(date -u '+%Y-%m-%d %H:%M UTC')"
+          git push