🧪 Integrate actionlint @ pre-commit framework

[webknjaz]

This includes bumping all the GitHub Actions to their recent versions and making the tag portion of the CI push trigger config for tags more explicit. These are the violations actionlint reported prior to this PR.

Contributor checklist

• Included tests for the changes.
• A change note is created in changelog.d/ (see changelog.d/README.md for instructions) or the PR text says "no changelog needed".

Maintainer checklist

• If no changelog is needed, apply the bot:chronographer:skip label.
• Assign the PR to an existing or new milestone for the target version (following Semantic Versioning).