ci: dependabot bumps generated workflow YAML instead of .github/ci/actions.toml

[MohammadHaroonAbuomar]

Dependabot #3138 (actions/checkout 7.0.0), #3206 (actions/setup-python 6.3.0), #3208 (actions/setup-dotnet 5.4.0) bump SHA pins in generated workflow YAML, so Check generated workflows fails (source .github/ci/actions.toml diverges).

Fix options:

1. One-off: maintainer PR updating .github/ci/actions.toml pins + re-run the generator.
2. Structural: point .github/dependabot.yml github-actions ecosystem at .github/ci/ (or add an ignore: for the generated files) so dependabot updates the source of truth instead.

Closed the 3 PRs; dependabot will re-propose after the actions.toml source is updated.