fix(release): stop dependabot from breaking tag releases (dist allow-dirty)

[krassx]

Revalidation of the two newly-merged PRs (#11 github-actions, #12 zip 7 -> 8),
plus a permanent fix for the release breakage that has now happened twice.

The problem, second occurrence

PR #11 bumped actions/checkout 6 -> 7 across every workflow. That again
rewrote the six pins inside .github/workflows/release.yml — a cargo-dist
generated file the plan job verifies byte-for-byte. dist plan has been
failing on main since it merged (exit 255), and since plan is the first
job of the real release workflow, the next vX.Y.Z tag push would have failed
before building a single artefact.

#11's diff touched only release.yml — nothing else.

Why regenerating again wouldn't hold

PR #10 fixed the first occurrence by regenerating the file and left a comment
asking reviewers not to merge such PRs. That didn't hold, and structurally it
can't:

• the PR is generated automatically every week
• dependabot cannot be told to skip a single file
• no published cargo-dist emits a newer checkout pin — 0.32.0 is the latest on
  both crates.io and upstream GitHub — so there is no version to upgrade into

So the guard has to go rather than the pin. allow-dirty = ["ci"] stops dist
verifying release.yml and keeps dependabot's @v7. This ends the recurrence
outright instead of deferring it: every workflow now agrees on v7, so no bump
gets proposed, and the next action major won't fail plan either.

The tradeoff, documented next to the key and in CLAUDE.md: dist-config
changes (targets, installers, publish-jobs, cargo-dist-version) no longer
propagate to the workflow on their own, and nothing warns. Editing any of them
now requires re-running dist generate in the same change.

Verified: dist plan exits 0 and still emits the full artefact set for all five
target triples, with release.yml left on checkout@v7.

Revalidation of #11 and #12

Full local CI replication, matching the workflows exactly (global
RUSTFLAGS: "-D warnings", cargo test --all-targets):

job	on merged main (before this PR)	with this PR
rustfmt	pass	pass
clippy	pass	pass
test	pass — 455 passed, 0 failed	pass
e2e	pass — 17/17 flows	pass
plan	FAIL (exit 255)	pass

Two checks specific to zip taking another major (7.2.0 -> 8.6.0):

• Wire format unchanged. Packed an artefact + mapping with the zip-8 binary
  and compared against the archive produced by e7de272 (pre-dependabot, zip
  2.4.2): byte-identical. Same entry names, method 0 stored for the artefact,
  method 93 (Z_STANDARD) for mapping.txt, same fixed 1980-01-01 mtime,
  extract-version and flag bits. Two consecutive zip majors, zero wire drift.
• MSRV still 1.88. zip 8.6.0's own floor is 1.88, so it doesn't raise the
  tree's (gimli, globset, plist, time already require it).
  cargo +1.88 check --all-targets passes, and the rust-version = "1.88"
  corrected in fix: unbreak tag releases after the dependabot batch, correct MSRV, drop unused indicatif #10 remains accurate.

Both dependency PRs are otherwise sound — no code changes were needed for either.

Not included

docs/unity-il2cpp-linenumber-mappings.md has unrelated in-progress edits in the
working tree; deliberately left out of this branch.

🤖 Generated with Claude Code