Finish the gha migration, and fix the ANTHROPIC_API_KEY/@v1 startup failure in claude.yml

[d-morrison]

Follow-on to #29, which migrated only the Claude and NEWS workflows.

1. Fix: every Claude Code run since #30 fails at startup

Every run of .github/workflows/claude.yml on main since e296df1 has
concluded startup_failure (latest:
https://github.com/UCD-SERG/shigella/actions/runs/33132530926, and eight
before it).

Cause: both Claude caller stubs pass an ANTHROPIC_API_KEY secret, but they
pin @v1, and Morrison-Lab/gha's claude.yml / claude-code-review.yml
only declare that secret at @v2. GitHub rejects a workflow_call that
passes a secret the callee does not declare, before any job starts -- which is
why the failure has no logs and no annotations.

The gha README already says both of these belong on @v2. Same for
check-news.yml, which news.yaml pins at @v1.

2. Migrate the remaining hand-maintained workflows to gha

current	gha replacement
check-spelling.yaml (insightsengineering action)	spellcheck.yml@v2
lint-changed-files.yaml (hand-rolled lintr)	lint-changed-lines.yml@v2
version-check.yaml (hand-rolled desc comparison)	version-check.yml@v2 + bump-dev-version.yml@v2

version-check inverts the convention deliberately: PRs stop touching
Version: at all, and bump-dev-version bumps it after each merge to main.
The repo already has both settings that pair needs ("Allow GitHub Actions to
create and approve pull requests", "Allow auto-merge") and no required status
checks, so WORKFLOW_TOKEN is not needed.

Staying hand-maintained, because gha models no equivalent: R-CMD-check.yaml,
R-check-docs.yml, check-readme.yaml, pkgdown.yaml, pr-commands.yaml,
copilot-setup-steps.yml, phase0-debug.yaml.

3. Add gha capabilities the repo is missing

lint-workflows, lint-yaml, lint-markdown, check-junk-files,
check-typos, check-secrets, check-links, check-phi,
check-new-line-breaks.

The three linters start warn-only (fail: false) because they scan the whole
tree and this repo has pre-existing drift; the rest are diff-scoped or already
clean.

Deferred

• test-coverage.yaml -> test-coverage.yml@v2: blocked on the CmdStan
  install/cache steps, which gha does not model. No .stan file is tracked on
  main and cmdstanr is not in DESCRIPTION, so those steps look vestigial
  -- but Chapter 2: Stan Model 2 Kronecker simulation (restructure) #13 is an open Stan PR, so settle that first.
• check-non-standard-chars.yml: would fail today on em-dashes in
  .claude/skills/reprexes/SKILL.md (24 lines) and
  .github/copilot-instructions.md (16 lines). Clean those first; the
  workflow has no paths-ignore input.
• Flipping lint-workflows / lint-yaml / lint-markdown to fail: true
  once their backlogs are cleared.
• check-ai-tells: needs threshold tuning against this repo's research prose.

[d-morrison]

Working on this --- please hold off until I'm done.

Posted by Claude Code (AI agent) --- not written by a human.

[d-morrison]

Done --- unclaimed. #33 is open, fully clean at f2a328f (27/27 checks green,
review verdict Ready for merge), and awaiting a merge decision from the
repository owner.

The deferred items in this issue's "Deferred" section stay open after #33
merges: the test-coverage migration, check-non-standard-chars, flipping
the three linters to blocking, and check-ai-tells.

Posted by Claude Code (AI agent) --- not written by a human.