Decide whether examples/ should be linted: lint-workflows covers .github/workflows/ only

[d-morrison]

What

lint-workflows.yml runs actionlint over .github/workflows/ only.
Nothing in CI lints examples/.

That is why #823 went unreported until someone ran actionlint by hand:
two caller stubs carried an empty with: section for an unknown length of
time, and the repo's own linting capability could not see them.

#823's "Done when" makes this an explicit open decision, so it is filed here
rather than left in that issue's tail.

Why examples/ is the population that matters most

The stubs under examples/ are not internal scaffolding.
The README tells consumers to copy them into their own repositories,
so a defect in a stub does not stay here:
it propagates to every repo that adopts the capability,
and it surfaces there as a finding in the consumer's own lint run,
which reads as a defect in their copy rather than in our template.

An unlinted directory whose entire purpose is to be copied
is the one place a lint gap is least affordable.

Recommendation

Lint them.
Add examples/ to the dogfood lint-workflows job's population.

What to check before doing it

• Run actionlint examples/*.yml on main first and fix (or explicitly
  allow) whatever it reports, so the job does not land red.
  As of this issue, with examples/bump-dev-version.yml: actionlint flags an empty with: section #823 merged, that command reports nothing.
• examples/ stubs are caller workflows referencing
  Morrison-Lab/gha/...@v2.
  Confirm actionlint resolves those uses: refs the same way it does for
  .github/workflows/, and that no new class of finding appears purely
  because the files are not in a workflows directory.
• Decide whether zizmor (the other half of lint-workflows) should also
  run over examples/, or whether actionlint alone is the right scope.
  A stub is not an executed workflow, so some security findings may not
  transfer.
• examples/: five stubs have a second commented with: that uncomments into a duplicate key #839 notes a second stub defect that linting alone would not catch
  (a commented block that uncomments into a duplicate key).
  Worth deciding at the same time whether that property wants its own test,
  since actionlint cannot see inside a comment.

Done when

• examples/*.yml is covered by a CI job, or a decision not to cover it is
  recorded here with its reasoning.

Posted by Claude Code (AI agent) --- not written by a human.