fix: standardize all factory repos on a single lifecycle workflow source

[castrojo]

Problem

The factory currently has lifecycle/bonedigger callers pointing at three different locations, all diverged:

Repo	Calls	Pinned SHA	SHA age
common	actions/lifecycle.yml	95dc404b → broken (predates file)	~2 weeks stale
bluefin	bonedigger/lifecycle.yml	af62628c	10 days stale
dakota	bonedigger/lifecycle.yml	30a240ea	4 days stale
bluefin-lts	nothing	—	missing entirely

This caused multiple startup_failure cascades today and means lifecycle automation is silently broken or absent across the factory.

Root causes

1. SHA pinning of internal projectbluefin/ refs — every change to lifecycle.yml requires manually bumping 3+ callers. When they drift, GitHub fails the run with "workflow file issue" — no clear error, hard to diagnose.

2. Two lifecycle workflow locations — actions/lifecycle.yml (moved there in actions#150, June 10) and bonedigger/lifecycle.yml. Some repos call one, some the other. common calls actions, bluefin/dakota call bonedigger.

3. v1.1.0 tag in projectbluefin/actions was cut from a commit that predates lifecycle.yml — so pinning to that tag gives you a SHA with no lifecycle.yml. This broke common's caller silently for 2+ weeks.

Proposed fix

Step 1 — immediate (unblock common): ✅ Done in common#712

Bump common's lifecycle-caller SHA from 95dc404b → 3f01fd8e (v1 HEAD).

Step 2 — eliminate SHA pinning for internal workflow refs

Switch all uses: projectbluefin/... workflow references from @SHA to @main. The SHA-pinning policy in AGENTS.md applies to external actions. Internal org refs should use @main — any breakage in the called workflow will fail CI immediately and be caught, rather than silently drifting for weeks.

Required changes:

• bluefin/bonedigger.yml: @af62628c → @main
• dakota/bonedigger.yml: @30a240ea → @main
• common/lifecycle-caller.yml: already SHA-based, but should move to @main after #712

Pre-commit actionlint already has no SHA-pin check (that's a separate hook). Renovate's SHA-pinning for projectbluefin/ refs is already disabled (bluefin#215). This just closes the gap in the caller files.

Step 3 — add lifecycle to bluefin-lts

bluefin-lts has no bonedigger.yml or lifecycle-caller.yml. It has no lifecycle automation at all. Add one mirroring the bluefin pattern.

Step 4 — fix the bad v1.1.0 tag in projectbluefin/actions

The v1.1.0 tag points to 95dc404b which predates lifecycle.yml. Delete and re-cut it to a commit that contains the file, or just delete it (the v1 floating tag is the correct reference).

Impact

Fixing these means:

• No more startup_failure from stale SHA pins on internal refs
• No more "lifecycle broken for weeks" silent failures
• Unified lifecycle automation across all factory repos
• Eliminates a class of Renovate SHA-bump PRs for internal refs