gateway: emit zizmor unpinned-tools ignore off the uses: line (closes #952)

[potiuk]

Fixes #952.

Problem

Dependabot's github_actions comment-updater only rewrites a # vX.Y.Z comment when the version is the trailing token -- file_updater.rb deliberately skips comments with text after the version (comment.end_with?(version)). The gateway emitted the sentinel step's zizmor ignore right after the version on the uses: line:

- uses: 1Password/load-secrets-action@<sha>  # v4.0.0  # zizmor: ignore[unpinned-tools] ...

so on a bump Dependabot updated the hash but left # v4.0.0 stale, and zizmor's ref-version-mismatch (medium) then failed CI -- fixed by hand in #932 and set to recur on every future bump of an ignored action.

Fix

Emit the ignore on the if: false line instead:

    - uses: 1Password/load-secrets-action@<sha>  # v4.0.1
      if: false  # zizmor: ignore[unpinned-tools] generated sentinel step is never executed
      with:
        version: "2.30.0"

It's still within the sentinel step's finding span (zizmor docs), so unpinned-tools stays suppressed, while the version tag is now the trailing token on the uses: line, so Dependabot keeps it in sync.

• gateway.py: build the uses: comment from the tag only; append the ignore to the if: false line.
• Regenerated .github/actions/for-dependabot-triggered-reviews/action.yml (2-line diff).
• test_gateway.py: assert the new placement and that the ignore never lands on the uses: line.
• Verified: gateway / allowlist-check tests pass, prek clean, zizmor clean on the composite, and the composite -> actions.yml read-back round-trips with no diff.

🤖 Generated with Claude Code