feat: add dependabot-notify reusable workflow

[xnoto]

What

Reusable workflow that posts a synthetic alert to the cluster Grafana's embedded Alertmanager API (POST /api/alertmanager/grafana/api/v1/alerts) when Dependabot opens a PR. Part of the Dependabot PR alerting pipeline (Discord delivery).

Dependabot PR → caller workflow (tfroot-github managed) → THIS workflow
→ Cloudflare Access (path-scoped app, tfroot-cloudflare)
→ Grafana Alertmanager → Discord contact point (kustomize-cluster CRs)

Details

• No checkout, no GITHUB_TOKEN permissions (permissions: {}); the PR payload is read from $GITHUB_EVENT_PATH.
• Alert labels: alertname=DependabotPR, severity=info, repository. Annotations carry PR number, title, and URL; generatorURL links back to the PR.
• curl -f + set -euo pipefail: delivery failures fail the job visibly in the caller repo's Actions tab.
• Requires CLOUDFLARE_AUTH_CLIENT_ID / CLOUDFLARE_AUTH_CLIENT_SECRET (existing GitHub Actions Access service token) and GRAFANA_ALERTS_TOKEN in caller repos — distributed by tfroot-github (stacked PR).

Merge order

First. Callers reference @main, so this must merge before the tfroot-github alerting PR takes effect.

Validation

• pre-commit run: actionlint, gitleaks, and all file hooks pass.
• Hook freshness checked: actionlint v1.7.12 already latest.