Normalize CI/CD workflows

[schmidtw]

Workflow Gaps

The following CI/CD workflows do not match the xmidt-org Ideal State.

Missing or misconfigured workflows

• ci.yml — missing top-level permissions: block (needs pull-requests: read, contents: write, packages: write)
• auto-releaser.yml — file does not exist (required for automated releases)
• approve-dependabot.yml — file is named dependabot-approver.yml instead, and references wrong shared workflow (uses xmidt-org/.github/.github/workflows/dependabot-approver-template.yml@main instead of xmidt-org/shared-go/.github/workflows/approve-dependabot.yml)
• proj-xmidt-team.yml — references wrong shared workflow (uses xmidt-org/.github/.github/workflows/proj-template.yml@proj-v1 instead of xmidt-org/shared-go/.github/workflows/proj-xmidt-team.yml)
• proj-xmidt-team.yml — missing top-level permissions: block (needs contents: read, issues: write, pull-requests: write)

Unpinned actions

• proj-xmidt-team.yml:16 — uses: xmidt-org/.github/.github/workflows/proj-template.yml@proj-v1 — must pin to full commit SHA with version comment
• dependabot-approver.yml:14 — uses: xmidt-org/.github/.github/workflows/dependabot-approver-template.yml@main — must pin to full commit SHA with version comment

Reference

• Reference repos: xmidt-org/wrpssp, xmidt-org/wrp-go