docs(ci): document the docker/login-action tag-resolution quirk (#394)

Dependabot has at least once bumped docker/login-action to an
untagged main-branch commit (PR #346) with a stale/misleading
trailing version comment, while sibling actions bumped in other PRs
resolved correctly (#351, #354) -- specific to this one action, not
general dependabot behavior. Neither of the issue's two suggested
mechanical fixes apply cleanly: extending the pin-check CI job lives
in a separate central reusable-workflow repo, and adding an ignore
rule would trade off automatic updates against this recurrence risk
-- both are maintainer decisions. Document the quirk so a future
docker/login-action bump gets its tag double-checked before merging.

Closes #364

Author: zircote

.github/dependabot.yml

@@ -43,6 +43,16 @@ updates:
   cooldown:
     default-days: 7
   directory: /
+  # Known quirk (nsip#364): dependabot has bumped docker/login-action to an
+  # untagged main-branch commit at least once (PR #346), leaving a stale/
+  # misleading trailing `# vX.Y.Z` comment on the uses: pin rather than
+  # landing on a real release tag. Sibling actions bumped in other PRs
+  # (actions/checkout, taiki-e/install-action -- see #351, #354) resolved
+  # correctly, so this is specific to docker/login-action, not a general
+  # dependabot behavior. When reviewing a docker/login-action bump PR,
+  # verify the target SHA matches a real tag
+  # (`gh api repos/docker/login-action/tags`) before merging -- do not
+  # trust the trailing version comment alone.
   exclude-paths:
   # gh-aw-generated workflows (gh aw compile). Every action embedded in these
   # files -- not just github/gh-aw-actions/** -- is version-locked to the