Add docs about how to update multitool's lockfile (#31)

We've added a companion CLI called (creatively) `multitool`, that
supports updating GitHub release based artifacts. In practice this is
most of the artifacts we end up working with, and adding support for
other, limited artifact sources seems tractable.

In an ideal world, we'll ultimately teach Renovate how to run updates to
our lockfile. However, looking at [Renovate's support for
Bazel](https://github.com/renovatebot/renovate/blob/d6d1e57763ffefa04767a4d01b028b1d39f27188/lib/modules/manager/bazel/index.ts#L17-L22)
artifact updates: Renovate will update GitHub releases, GitHub tags, Go
datasources, and docker datasources. This is relatively limited, and our
read is that GitHub releases covers the bulk of the artifacts one
expects to encounter.

Additionally, we'd like to make it easy to add new tools and more
generally to manage the lockfile, and plan to add `add`, `remove`, and
`lint` commands to our CLI down the road. We think that'll be useful
even if we had full Renovate support.

In addition to describing that the CLI exists, this PR includes sample
GitHub Actions to use within one's repo. Publicly, one can see the
download-and-execute example in
[rules_uv](https://github.com/theoremlp/rules_uv/blob/main/.github/workflows/periodic-update-multitool.yml).

Partial solution to #28.

readme.md

@@ -74,3 +74,9 @@ A common pattern we recommend to further simplify invoking tools for repository
     bazel run "@multitool//tools/$( basename $0 ):cwd" -- "$@"
     ```
 1.  Create symlinks of `tools/tool-name` to `tools/_run_multitool.sh`
+
+### Keeping Tools Up-to-Date
+
+We provide a companion CLI [multitool](https://github.com/theoremlp/multitool) to help manage multitool lockfiles. The CLI supports basic updating of artifacts that come from GitHub releases, and may be extended in the future to support other common release channels.
+
+See [our docs](docs/automation.md) on configuring a GitHub Action to check for updates and open PRs periodically.