ci: add actionlint config suppressing SC2129 in workflow files

Companion to 0004: the validator continues to flag SC2129 ("Consider
using { cmd1; cmd2; } >> file instead of individual redirects") at
style severity in updates.yaml — the create_pr_update block has five
sequential `>> "$GITHUB_OUTPUT"` redirects interleaved with conditional
logic, so the linearized form reads more clearly than the bundled
brace-group equivalent.

Suppress repo-wide via `.github/actionlint.yaml` rather than per-block
shellcheck directive: applies consistently if a future workflow grows
a similar redirect chain, and keeps the workflow files themselves
free of inline lint suppressions.

Refs: PSEC-923

Author: stevebeattie

.github/actionlint.yaml

@@ -0,0 +1,13 @@
+# Repo-wide actionlint configuration.
+#
+# Suppression rationale:
+# - SC2129 is a shellcheck *style* finding suggesting `{ cmd1; cmd2; } >> file`
+#   instead of N individual `>> file` redirects. The linearized form is more
+#   readable in GitHub Actions `run:` blocks where conditional logic is
+#   interleaved between redirects (e.g., updates.yaml's create_pr_update
+#   flag), so we suppress this rule repo-wide rather than refactor every
+#   block.
+paths:
+  '.github/workflows/**':
+    ignore:
+      - 'shellcheck reported issue.*SC2129'