fix(ci): run dependency PR file/git ops inside a clone of the target repo

docs/specs/DEVX-165.md

@@ -17,11 +17,19 @@ in a JSON manifest. Two gaps in devx block that:
 ## Approach
 
 REQ-1: `create_dependency_pr` gains `--manifest <path>` +
-`--verify-container <owner/name>`: before opening the PR it resolves the
-container tag's OCI digest via the registry `manifests` API
-(`Docker-Content-Digest`), then updates manifest fields
-`{version, git_ref, image_tag, image_digest, source_commit, updated_at}`
-in the PR branch instead of a regex bump.
+`--verify-container <owner/name>` + `--container-tag` +
+`--source-ref`: before opening the PR it resolves the container tag's
+OCI digest via the packages API (`manifest.json` blob sha256), then
+updates manifest fields `{version, git_ref, image_tag, image_digest,
+source_run_id, updated_at}` in the PR branch instead of a regex bump.
+`--container-tag` decouples the image tag from the release version
+(sso-bridge images tag `__init__.py.__version__`, not the git tag).
+
+REQ-1b: `create_dependency_pr` clones the *target* repo into a tempdir
+and performs all file lookups and git operations inside it. Previously
+it operated on CWD — the producer repo's own checkout — so file updates
+silently targeted the wrong repo and the whole dep-PR path no-oped
+behind `|| echo warning`.
 
 REQ-2: `clean_images` gains `--protect` (repeatable): named versions are
 never deleted regardless of `--keep` trimming.