chore(deps): add dependabot and SHA-pin workflow deps (#456)

Introduces Dependabot & SHA-pins workflow deps, as per the [Discord
thread](https://discord.com/channels/1358869848138059966/1399986970851282954/1415896798144368762).

A note on the commit message: I used convention commit format out of
habit, but can rewrite the it to adhere to the
[styleguide](https://go.dev/wiki/CommitMessage) if critical.

.github/workflows/docs-check.yml

@@ -0,0 +1,39 @@
+name: Docs Check
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - 'internal/readme/**'
+      - 'README.md'
+      - 'internal/docs/**'
+      - 'docs/**'
+
+permissions:
+  contents: read
+
+jobs:
+  docs-check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set up Go
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5
+      - name: Check out code
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
+      - name: Check docs are up-to-date
+        run: |
+          go generate ./...
+          if [ -n "$(git status --porcelain)" ]; then
+            echo "ERROR: docs are not up-to-date!"
+            echo ""
+            echo "The docs differ from what would be generated by `go generate ./...`."
+            echo "Please update internal/**/*.src.md instead of directly editing README.md or docs/ files,"
+            echo "then run `go generate ./...` to regenerate docs."
+            echo ""
+            echo "Changes:"
+            git status --porcelain
+            echo ""
+            echo "Diff:"
+            git diff
+            exit 1
+          fi
+          echo "Docs are up-to-date."