GitHub is a push mirror of the Forgejo canon, not a peer. The sync force-matches
refs, so every branch dependabot opens is deleted within the hour and its PR
closes itself. Two runs proved it (checkout 4->7 and setup-node 4->7, both
opened 2026-08-24, both auto-closed): the loop cannot land a change, and a
public repo whose only PRs are self-closed bot PRs reads as abandoned.
The bot's one useful output was taken by hand — publish.yml already pins
actions/checkout@v7 and actions/setup-node@v7, shipped in 0.1.0.
FORK.md records why, so restoring the file is a decision and not an oversight.
3074417d64