Automate actions/runner version bumps: scheduled PR workflow + bump script

[kurok]

Problem

Bumping the default actions/runner version is a recurring manual chore with a documented multi-file recipe: copy checksums from the release body, edit src/runner-checksums.js, action.yml, config defaults, tests, and docs, remember to npm ci before npm run package or verify-dist churns (#36 is a recent example of the ritual). GitHub ships runner releases roughly monthly, and stale pinned versions eventually hit the runner's minimum-version enforcement — meaning this chore is load-bearing, deadline-driven, and entirely mechanical. Mechanical + recurring + multi-file = automate it.

Proposal

Scheduled bump workflow (Dependabot-style, in-repo)

• Weekly scheduled workflow + manual dispatch:
  1. Query the latest actions/runner release via the GitHub API.
  2. If newer than the pinned default: extract the x64 (and arm64, once the architecture issue lands) tarball SHA-256 values from the release body.
  3. Run a repo script (scripts/bump-runner.js — the codified recipe) that updates runner-checksums.js, the action.yml default, config defaults/tests, and docs in one pass, then npm ci && npm run package.
  4. Open a conventional-commit PR (fix: bump default actions/runner to X.Y.Z) with the release notes linked and the checksum provenance (release URL) in the body.
• Trust boundary: checksums come from the release body of the official actions/runner repo over the authenticated API; the PR body cites the source so review is a link-click. No auto-merge — a human merges (runner updates occasionally break things; the automation removes toil, not judgment).
• The script is also the manual path (node scripts/bump-runner.js 2.336.0) — one command replaces the recipe for hotfix bumps.

Acceptance criteria

• scripts/bump-runner.js updates every file the current recipe touches — enumerated in the script and verified by a test that runs it against a fixture tree and snapshots the diff; running it twice is idempotent.
• Checksum extraction parses the actual release-body format (fixture from a real release; tolerant of whitespace changes, failing loudly on format drift rather than writing garbage).
• Workflow: detects newer release, produces a green PR (dist rebuilt, verify-dist passes, unit tests updated/passing) with cited provenance; no-op run (already latest) exits quietly without a PR.
• arm64 checksums handled when present in runner-checksums.js (forward-compatible with the architecture issue; single-arch today must not break).
• Workflow permissions minimal (contents: write, pull-requests: write), actions SHA-pinned, no secrets beyond GITHUB_TOKEN.
• Docs: the manual recipe in CONTRIBUTING/README replaced by "run the script / merge the bot PR"; the recipe's gotcha (npm ci before package) now encoded in the script, not prose.
• Lint + tests green; dist changes only from the script's own rebuild.

Out of scope

• Auto-merge (deliberately excluded).
• Runtime runner-version: latest (unpinned checksums would defeat the checksum verification — rejected; pinning + fast bumps is the model).
• Bumping other dependencies (Dependabot already covers npm/actions).

Part of the roadmap (see tracking issue). Pure toil-elimination with a security-hygiene side effect (never stuck on a stale runner).