Dependabot cannot produce a green bump: it moves workflow pins but not the declared catalog they are validated against #37

What

Every grouped GitHub Actions bump in this repository lands red, and will keep doing so, because two facts about a tool version live in different places and only one of them is machine-updated.

• uses: owner/action@<sha> # vX.Y.Z in .github/workflows/*.yml — Dependabot owns this.
• catalog/tools.yml, the harden-runner contract, the scorecard evidence contract and the generated matrices under docs/generated/ — nothing automated owns these.

validate_all --tier core compares them and fails, correctly:

[FAIL] tool-registry
[FAIL] harden-runner-contract
[FAIL] scorecard-evidence-contract
[FAIL] catalog

Observed on #9 (setup-uv v9.0.0 → v10.0.1, harden-runner v2.20.0 → v2.21.0). The same shape exists in NDDev-Technocracy-OpenNetwork/github-device-sync#3, where a gomod bump breaks GDS_CONTEXT_POLICY_SOURCE_DIGEST_MISMATCH — source moved, the declared state hashed over it did not.

Why this is not just "rebase the PR"

The validators are the point. They exist so a pin cannot drift from its declared contract silently, and they are working. The gap is that the repository has no supported path for a bump to arrive with its regenerated declaration, so the only outcomes today are a permanently red PR or a human doing the regeneration by hand on every bump.

What would close this

Either of these, not both:

• a regeneration step Dependabot can trigger — a workflow on dependabot/** branches that regenerates the catalog, contracts and generated matrices and pushes to the same branch, so the PR converges on its own;
• or a validator mode that derives the catalog from the workflow pins rather than comparing two hand-maintained lists, removing the second source of truth entirely.

The second is smaller and removes the class rather than automating around it.

Acceptance

A grouped Dependabot bump reaches green with no human edit, and a pin that moves without its declared contract still fails.