fix(ci): regenerate actions.lock with the repair chain after the base merge

The base merge (88d2e49) brought in dependabot's bumps (#216, #217) and a
hand-resolved lock. The estate repair chain was re-run in CI on this
exact head (09a5857) with a real token: relock-sha-keys,
complete-job-refs, close-lock, prune-stale, check-lock-sync, all RC=0,
and the governance gate at standards 333b06a0 returned "Immutable direct
and transitive lockfile coverage verified". The chain changed one line:
the slsa-github-generator record's ref label, f7dd8c54 -> v2.1.0. This
file matches the run's LOCK-SHA256
7555257dddf72015654fdf619089d0e270b45e9ba2fc32f1fdb5046f43111f66.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3

Author: claude

.github/workflows/actions.lock

@@ -236,7 +236,7 @@ dependencies:
         owner_id: 18365890
         repo_id: 220359305
     'slsa-framework/slsa-github-generator@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a':
-        ref: 'f7dd8c54c2067bafc12ca7a55595d5ee9b75204a'
+        ref: 'v2.1.0'
         commit: 'sha1-f7dd8c54c2067bafc12ca7a55595d5ee9b75204a'
         owner_id: 80431187
         repo_id: 475074978