Add @girs dependency auto-update workflow

[JumpLink]

Automates keeping the @girs/* type dependencies on the latest stable release, so we don't have to bump them by hand after every ts-for-gir release.

What it does

• scripts/update-girs.mjs — pins every @girs/* dependency to its npm latest dist-tag as an exact version. Exact pins are deliberate: @girs encodes the library version and the ts-for-gir version in a single semver string (e.g. 2.88.0-4.0.4), which makes a stable suffix sort below a release-candidate suffix, so caret/tilde ranges resolve back to the rc instead of the stable release (this is the root cause of Dependency versions stuck on release candidate #125). The script only touches the version of existing @girs/* keys — it never adds, removes or renames packages, and leaves protocol specifiers like workspace: alone.
• yarn update:girs — convenience script that runs the above for both the package and the hello-world example.
• .github/workflows/update-girs.yml — runs the bump on a daily schedule, on manual workflow_dispatch, and on a repository_dispatch of type girs-release. It installs, runs the full validation (build:types, prettier:check, validate:types, build:example, validate:example), and then opens or updates a single chore/update-girs PR — but only when something actually changed. If validation fails (a new @Girs release needs code changes here), the PR is opened as a draft with a warning linking to the run, so the breakage surfaces as an actionable PR instead of a silent red run.

Notes

• Self-contained: no secrets and no changes to other repos. The daily poll picks up a release within a day; the girs-release repository_dispatch hook is there if we later want ts-for-gir to trigger it instantly (one gh api .../dispatches call from its release workflow + a cross-repo token).
• PRs created by the default GITHUB_TOKEN don't trigger the Build CI workflow, so the workflow runs the equivalent validation itself; the PR body notes this and how to get a separate Build CI run if wanted.
• Schedule/dispatch only activate once this is on main (default branch). After merge it can be smoke-tested from the Actions tab via Run workflow.

Verified locally: yarn update:girs produces the expected exact-pin bumps end-to-end, the workflow YAML parses, and the full CI sequence is green on this branch.

[JumpLink]

These changes were merged prematurely by mistake; main has been rewound to before the merge so the change can go through review first. Superseded by #135 (same branch/commits).