catalog: update Dune Ops Observability to v0.5.0 - #24

main's branch protection has required a "CI Gate" status check since
this repo was created, but no workflow file defining that check has
ever existed anywhere in this repo's history (confirmed via full tree
search across every branch and GitHub code search across all commits,
in both this fork and upstream Red-Blink/dune-docker-addons). Every PR
against main, including #2, has been stuck in a permanently BLOCKED
merge state as a result, despite being otherwise mergeable.

Adds two files, sourced from PR #1 (feat/soc2-compliance), which
already defined a working version of this exact workflow and had a
green CI run recorded against it before that branch went stale:

- .github/workflows/ci.yml: three jobs (Validate JSON, Security,
  CI Gate). CI Gate fans in the other two jobs' results and fails the
  overall check if either did not succeed, which is what main's branch
  protection actually polls for.
- .github/dependabot.yml: weekly github-actions dependency updates,
  unrelated to CI Gate itself but bundled with it in the source branch
  and has no downsides to including here.

Deliberately NOT included from PR #1's branch: compliance/README.md.
That file is Arrakis-Control-Panel's SOC 2 compliance boilerplate,
copied into this unrelated static-addon-catalog repo without adaptation
-- it opens by name-checking "the ACP ecosystem" in a repo that is not
ACP, and links to nine files (controls/soc2-matrix.md, five policy
docs, four runbook docs) that do not exist anywhere in this repository.
This repo has no runtime service, no user data, and nothing to run a
SOC 2 audit against, so a compliance program does not fit its actual
scope. Left out here rather than landing broken links and a
wrong-repo-name doc on main; PR #1 remains open for separate review of
that content.

Also fixes two dependency-freshness problems in the workflow, found
while validating it would actually keep working going forward rather
than just checking it ran once historically:

- gitleaks/gitleaks-action@v2 to @V3. v2 runs on the Node 20 Actions
  runtime, which GitHub already requires an explicit opt-out flag for
  as of 2026-06-02 and removes entirely on 2026-09-16 -- about seven
  weeks from this commit. v3 has no input/output/behavior changes per
  the action's own migration note, just the Node 24 runtime bump.
- returntocorp/semgrep-action@v1 replaced with running the semgrep CLI
  directly via its official Docker image. Both returntocorp/semgrep-
  action and its semgrep/semgrep-action successor are explicitly marked
  deprecated by their own READMEs ("stop using this wrapper script...
  migrate to native Semgrep support instead"); running the CLI directly
  is semgrep's own current recommended CI approach and avoids
  depending on an unmaintained wrapper at all.

Verified locally before committing:
- python3 -c "import yaml; yaml.safe_load(open('.github/workflows/ci.yml'))"
  and the same for dependabot.yml: both parse as valid YAML.
- python3 -c "import json; json.load(open('index.json'))" and the
  equivalent find/loop over addons/*.json: both pass against this
  repo's current content, confirming the Validate JSON job's own logic
  is correct against real data, not just syntactically present.
- gitleaks detect --source . -v: 81 commits scanned, no leaks found.
- semgrep --config p/security-audit --error . (installed locally,
  version 1.168.0): 0 findings, exit 0.
- docker run --rm -v "$PWD:/src" semgrep/semgrep semgrep --config
  p/security-audit --error /src: ran the exact command this workflow
  uses, confirmed 0 findings and exit code 0.

ci: add CI Gate workflow required by branch protection

Add project funding options

…on PRs)

Fork-local addition only -- does not touch tracked upstream catalog
content (addons/, index.json). Complements the existing ci.yml's
Docker-invoked semgrep --config p/security-audit (Community-tier,
no login) with logged-in semgrep ci (Pro rules + Supply Chain).

ci: add Semgrep CI workflow (full ruleset + Supply Chain)

v0.5.0 — Phase 0: Tab-Aware Lazy Loading & Grafana Fix
- Tab-aware lazy loading (active tab dispatches only its providers)
- Placeholder tabs (AAA, NOC Infra, Audit Log) for L1-designed metrics
- Grafana HTTPS/HTTP mode toggle with mixed-content explanation
- Inventory layout fix (4th metric card, empty state)
- Freshness badges, NOC service table, CSP frame-src fix
- L2+L3 Eight-Hat Audit completed, 57/57 tests pass