ci: sync bun.lock on Dependabot PRs

[beogip]

Summary

Dependabot updates package.json but does not regenerate Bun's text bun.lock (known upstream bug: dependabot/dependabot-core#11602). Every dependency PR therefore fails CI at bun install --frozen-lockfile, e.g. #43.

This adds a workflow that runs only on Dependabot PRs, regenerates bun.lock with bun install --lockfile-only, and pushes it back to the branch. The pushed commit retriggers CI with a consistent lockfile.

Why a push credential is needed

Commits pushed with the default GITHUB_TOKEN do not retrigger workflows, and on Dependabot-triggered runs that token is read-only anyway. The push therefore uses DEPLOY_KEY (the same read-write SSH deploy key already used by the release job).

Required manual step before this works

DEPLOY_KEY must be added as a Dependabot secret (Settings > Secrets and variables > Dependabot), not only an Actions secret. Actions secrets are not exposed to Dependabot-triggered runs.

Type of change

• Bug fix
• CI / tooling

Testing

• Will be validated on the next Dependabot PR (or by re-running chore: bump typescript from 6.0.3 to 7.0.2 in the npm-dependencies group across 1 directory #43) once the Dependabot secret is set.