ring0 dogfood: .github's own agent-shield/dependabot-automerge callers are frozen @v2, not local-ref HEAD #541

Problem

.github is the ring0 tier in the canary-ring topology (epic #495) — the dogfood that should run the latest reusable code on its own automation so regressions surface at the source before any promotion. Most of its own callers already do this via the local-ref form:

uses: ./.github/workflows/<name>-reusable.yml  # local ref — always current

But two are frozen on a stale cross-repo tag, so they do not dogfood:

Both reusables have advanced on main since @v2, so ring0 is silently running old code for these two — the dogfood tier isn't exercising the moving channel. Surfaced during the #870 @v1/@v2 grace-drop fleet scan.

(Note: dev-lead.yml correctly uses @dev-lead/ring0 — it's cross-repo, so a local ref isn't possible. .github/workflows/dependency-audit.yml is a full inline workflow, not a stub — separate concern.)

Fix

Cut the two callers over to the local-ref form, matching auto-rebase.yml / dependabot-rebase.yml / pr-review-mention.yml. .github is exempt from the centralized-stub audit, so no audit change is needed; this only affects .github's own repo automation (the safest place to dogfood).

Refs #870, #495.