Make the governance workflows reusable #38

Context

Each consumer repo carries its own copy of conventional-commits, update-action-pins, osv-scanner, issues-add-labels and issues-add-to-project. The copies have drifted. update-action-pins alone exists in three variants:

• ocm-components: strips quotes and allows any YAML sequence spacing, so uses: "foo@v1" or - uses: can't slip through. Scans .github/workflows/ only, runs on every PR.
• dev-kit: scans all of .github/ (workflows and composite actions), but doesn't strip quotes, and is gated with on.pull_request.paths, which leaves a required check pending forever on PRs that don't touch those paths.
• solution-arsenal, artifact-conduit: neither quote handling nor composite actions.

Part of centralizing shared CI/build config in dev-kit: a fix to a governance check should reach every repo through one dev-kit release.

Only the scorecard item waits for the scorecard spike (#37); everything else can start right away.

What needs to be solved

1. Merge update-action-pins into one version: the ocm-components matcher, scanning all of .github/, no paths filter.
2. Convert the governance workflows to workflow_call, with inputs where repos genuinely differ.
3. One caller stub per workflow, carrying that workflow's triggers and only the permissions its own jobs need. (Grouping by trigger doesn't fit: osv-scanner runs on PRs, merge queue, push and a schedule, so grouped stubs would need if: guards and a union of permissions.) scorecard per the spike's outcome.
4. Provide the caller stubs as copy-ready examples in the README.
5. make repo-settings stops copying update-action-pins.yml into consumers, since the stub replaces the copy.

Acceptance criteria

• dev-kit runs the governance workflows on its own events from the same files consumers call (workflow_call next to the regular triggers), so no separate stubs in dev-kit.
• update-action-pins fails on a quoted tag ref, on - uses: spacing, and on an unpinned composite action; passes on a fully pinned repo.
• The README lists the resulting check names (<caller-job> / <called-job>) for use in REPO_STATUS_CHECKS.
• No stub has broader permissions than its jobs need.