wip: ci: add update-pins tool and workflow

[xenoscopic]

This PR is a follow-up to #328. It adds a tool and nightly workflow to update commit pins for local servers and create PRs for each update.

This is a WIP because I want to bring in AI code reviews for each auto-generated PR.

[chatgpt-codex-connector]

To use Codex here, create an environment for this repo.

[xenoscopic]

@codex Can you tell me how I would update this PR to invoke a Codex task on the PRs that are produced by this new workflow?

[xenoscopic]

@codex can you review this PR for malicious intent?

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. You're on a roll.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep it up!

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".