ci: run full installer end-to-end; add Dependabot for actions

The validate job checks configs but never executes install.sh, which
is what actually rots (apt repo URLs, GPG fingerprints, pinned
checksums). New job runs the complete install plus --unlink as a
normal user in a pristine ubuntu:24.04 container. Dependabot keeps
the pinned GitHub Actions current monthly.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/dependabot.yml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly

.github/workflows/validate.yml

@@ -31,3 +31,27 @@ jobs:
 
       - name: Validate
         run: bin/check-dotfiles
+
+  # End-to-end installer test: the dotfiles job validates the configs but
+  # never runs install.sh itself, which is what rots (apt repo URLs, GPG
+  # fingerprints, pinned checksums). Run the full install as a normal user
+  # in a pristine container.
+  installer:
+    runs-on: ubuntu-24.04
+
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - name: Run full installer in a fresh container
+        run: |
+          docker run --rm -v "$PWD:/src:ro" ubuntu:24.04 bash -ec '
+            export DEBIAN_FRONTEND=noninteractive
+            apt-get update
+            apt-get install -y --no-install-recommends sudo curl ca-certificates git
+            useradd -m -s /bin/bash tester
+            echo "tester ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/tester
+            cp -r /src /home/tester/dotfiles
+            chown -R tester:tester /home/tester/dotfiles
+            su tester -c "cd ~/dotfiles && install/install.sh"
+            su tester -c "cd ~/dotfiles && install/install.sh --unlink"
+          '