fix(ci): Vendor Update bumps for a new const module but never commits it #1685

Describe the bug
Vendor Update commits with git commit -am (.github/workflows/cron-vendor.yml:267). That stages modified and deleted tracked files, but never untracked ones. So when a crawl generates a brand-new const module, for a registry IANA added:

• tj-actions/verify-changed-files reports it, so files_changed is true;
• Bump Version runs, and the version is bumped and pushed;
• but the new module itself is left out of the commit.
  The release then ships without the module that justified it, and every later crawl finds it untracked again, so it bumps every run.

Found while reviewing #1684, which keeps this step as is; its comment-only path never sees a new file, because a new file always classifies as code.

Expected behavior
Vendor Update commits every file verify-changed-files reports, untracked ones included (for example git add -A pcapkit/const before the commit), so a bump always carries the files that caused it.