chore: deploy agentic workflows

.gitattributes

@@ -0,0 +1 @@
+.github/workflows/*.lock.yml linguist-generated=true merge=ours

.github/actionlint.yaml

@@ -0,0 +1,9 @@
+# Skip gh-aw machine-generated workflow files (validated by `gh aw lint`/`compile`).
+# Auto-applied by actionlint regardless of which security-scan invokes it.
+paths:
+  "**/*.lock.yml":
+    ignore:
+      - ".*"
+  "**/agentics-maintenance.yml":
+    ignore:
+      - ".*"

.github/aw/actions-lock.json

@@ -0,0 +1,19 @@
+{
+  "entries": {
+    "actions/github-script@v9.0.0": {
+      "repo": "actions/github-script",
+      "version": "v9.0.0",
+      "sha": "3a2844b7e9c422d3c10d287c895573f7108da1b3"
+    },
+    "github/gh-aw-actions/setup-cli@v0.79.4": {
+      "repo": "github/gh-aw-actions/setup-cli",
+      "version": "v0.79.4",
+      "sha": "d059700c6a8ec3b5fd798b9ea60f5d048447b918"
+    },
+    "github/gh-aw-actions/setup@v0.79.4": {
+      "repo": "github/gh-aw-actions/setup",
+      "version": "v0.79.4",
+      "sha": "d059700c6a8ec3b5fd798b9ea60f5d048447b918"
+    }
+  }
+}

.github/dependabot.yml

@@ -1,18 +1,18 @@
-# Copyright 2026 ResQ Software
-# SPDX-License-Identifier: Apache-2.0
-#
-# Weekly dependency updates, grouped to keep PR noise low.
-
-version: 2
 updates:
-  - package-ecosystem: github-actions
-    directory: /
-    schedule:
-      interval: weekly
-      day: monday
-      time: "06:17"
-    groups:
-      actions:
-        patterns: ["*"]
-    labels: [chore, deps]
-    open-pull-requests-limit: 5
+- directory: /
+  groups:
+    actions:
+      patterns:
+      - "*"
+  ignore:
+  - dependency-name: "github/gh-aw-actions*" # Managed by gh aw compile. Version-locked to the gh-aw compiler; do not bump.
+  labels:
+  - chore
+  - deps
+  open-pull-requests-limit: 5
+  package-ecosystem: github-actions
+  schedule:
+    day: monday
+    interval: weekly
+    time: "06:17"
+version: 2