docs(standards): address Copilot review — SHA-pin rationale and adoption guidance

- Add explicit comment that no semver tags exist for this internal
  reusable workflow, so SHA pinning is intentional (not a deviation
  from @v1 guidance that applies to external actions)
- Include lookup command so maintainers know how to get the current SHA
- Clarify "To adopt" line to point at standards/ template and warn
  against copying the local-ref .github/workflows/ version

Addresses Copilot review comments on PR #145.

Co-authored-by: Don Petry <don-petry@users.noreply.github.com>

Author: github-actions[bot]

standards/workflows/dependabot-rebase.yml

@@ -8,6 +8,10 @@
 #     lives in the reusable workflow above.
 #   • You MAY change: the SHA in the `uses:` line when upgrading the reusable
 #     workflow version (bump SHA to latest main of petry-projects/.github).
+#   • SHA-pinned intentionally (not @v1): no semver tags are maintained for
+#     this internal reusable workflow. Downstream repos pin to a specific
+#     commit SHA and bump deliberately. To look up the current SHA:
+#     gh api repos/petry-projects/.github/branches/main --jq '.commit.sha'
 #   • You MUST NOT change: trigger event, the concurrency group name,
 #     the explicit secrets block, or the job-level `permissions:` block —
 #     reusable workflows can be granted no more permissions than the calling
@@ -18,7 +22,10 @@
 # ─────────────────────────────────────────────────────────────────────────────
 #
 # Dependabot update-and-merge — thin caller for the org-level reusable.
-# To adopt: copy this file to .github/workflows/dependabot-rebase.yml in your repo.
+# To adopt: copy THIS file (standards/workflows/dependabot-rebase.yml) to
+#   .github/workflows/dependabot-rebase.yml in your repo. Do NOT copy
+#   .github/workflows/dependabot-rebase.yml from this repo — that file uses a
+#   local ref only valid in the source-of-truth repo.
 # Required org/repo secrets (inherited):
 #   APP_ID         — GitHub App ID with contents:write and pull-requests:write
 #   APP_PRIVATE_KEY — GitHub App private key