Merge dev into main: keep the shared-action ref that actually resolves

One conflict, deps.yml, add/add: both branches added the deps bump-tracker from
the same template and they differ only in the ref the shared action is pinned
to — dev `@dev`, main `@v4`.

Checked at the source: `dAppCore/build` publishes branches main, v2, v3 and v4
(v4 == main) and has no `dev` branch, so `@dev` is a dangling ref that fails at
action-resolution time. Resolved to `@v4`. Dev's intent — track dependency
bumps — is fully carried by main's copy.

Worth recording what the merge preserved without conflicting. Main's lint fix
(8b2873f) dropped `--tests=false` from the golangci step and added .golangci.yml
to scope the exclusions per-rule instead; dev never touched either file, so git
kept the fix cleanly. That fix is load-bearing here: `--tests=false` hid the test
files from every linter, and `unused` then read the WebSocket hub in pkg/api —
built only by provider_test.go — as 19 dead symbols, with deletion as the
suggested remedy. The merged tree keeps the fix and the .golangci.yml it depends
on together.

Gate (GOWORK=off, in go/): build clean, vet clean, tests pass across process,
process/exec and process/pkg/api — the hub package included.

Co-Authored-By: Virgil <virgil@lethean.io>

Author: Snider