Add workflow to check for updates to pseudo-versioned dependencies

Dependabot does not support updating Go dependencies pinned to commits
(pseudo-versions). This workflow fills that gap by checking if newer
commits are available on the default branch.

See: dependabot/dependabot-core#2028

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <[email protected]>

Author: horgh

.github/workflows/check-untagged-deps.yml

@@ -0,0 +1,20 @@
+name: Check Untagged Dependencies
+
+on:
+  push:
+  pull_request:
+  schedule:
+    - cron: '0 14 * * *'
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - uses: horgh/check-untagged-go-deps@b2bec8a7a0c8da55e64b092013f7bf5dff1006ca # v1.0.1