feat(workflow): complete wave-f detector set

[jonathansantilli]

Summary

• completes Wave F detector implementation with four additional audits:
  • workflow-oidc-untrusted-context
  • workflow-dynamic-matrix-injection
  • dependabot-auto-merge
  • workflow-local-action-mutation
• wires all new audits into the static engine workflow-audit pipeline
• adds detector-level tests for each new audit
• extends Wave F engine integration coverage to assert all new rule IDs are surfaced
• updates parity documentation and contract tests so Wave F is fully checked

What This Adds

• OIDC risk detection for untrusted-trigger jobs minting tokens without strict trust boundaries and audience constraints
• dynamic matrix injection detection when strategy.matrix is sourced from attacker-controlled event payloads and then used in shell execution
• Dependabot auto-merge confused-deputy detection for weak actor-only bot gating on privileged triggers
• local action mutation detection for uses: ./... execution paths reachable from untrusted events, with privilege-aware severity

Verification

• npm run typecheck
• npm run lint -- src/layer2-static/detectors/workflow-oidc-untrusted-context.ts src/layer2-static/detectors/workflow-dynamic-matrix-injection.ts src/layer2-static/detectors/dependabot-auto-merge.ts src/layer2-static/detectors/workflow-local-action-mutation.ts src/layer2-static/engine.ts tests/layer2/workflow-oidc-untrusted-context.test.ts tests/layer2/workflow-dynamic-matrix-injection.test.ts tests/layer2/dependabot-auto-merge.test.ts tests/layer2/workflow-local-action-mutation.test.ts tests/layer2/workflow-wave-f-engine.test.ts tests/meta/workflow-audit-parity-contract.test.ts
• npm test -- tests/layer2/workflow-oidc-untrusted-context.test.ts tests/layer2/workflow-dynamic-matrix-injection.test.ts tests/layer2/dependabot-auto-merge.test.ts tests/layer2/workflow-local-action-mutation.test.ts tests/layer2/workflow-wave-f-engine.test.ts tests/meta/workflow-audit-parity-contract.test.ts
• npm test -- tests/layer2/workflow-*.test.ts tests/layer2/dependabot-*.test.ts tests/meta/workflow-audit-parity-contract.test.ts