ci: lint workflow files with actionlint

Add a dedicated workflow that runs actionlint on `.github/workflows/**`.
It catches what plain YAML validity doesn't — undefined `needs`/job
references, malformed `${{ }}` expressions, unknown action inputs, and
(via shellcheck) issues in `run:` scripts. A dead `needs:` reference
previously shipped because nothing guarded the workflows themselves.

Author: loss-and-quick

.github/workflows/lint-workflows.yml

@@ -0,0 +1,43 @@
+name: Lint Workflows
+
+# Lint the workflow files themselves. actionlint catches what YAML validity can't:
+# undefined `needs`/job references, bad `${{ }}` expressions, unknown action inputs,
+# and (via its shellcheck integration) shell issues in `run:` blocks. A broken
+# `needs:` reference once shipped silently because nothing here guarded it.
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/**'
+  push:
+    branches: [main]
+    paths:
+      - '.github/workflows/**'
+
+permissions:
+  contents: read
+
+jobs:
+  actionlint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - name: Install actionlint
+        # Pinned by version; the download is verified against the release's own
+        # published checksums. taiki-e/install-action doesn't carry actionlint, and
+        # curl|bash of an upstream script pins nothing — this does both.
+        env:
+          ACTIONLINT_VERSION: 1.7.12
+        run: |
+          base="https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}"
+          curl -fsSL "${base}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz" -o actionlint.tar.gz
+          curl -fsSL "${base}/actionlint_${ACTIONLINT_VERSION}_checksums.txt" -o checksums.txt
+          grep "actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz" checksums.txt | sha256sum -c -
+          tar -xzf actionlint.tar.gz actionlint
+          install -m 0755 actionlint /usr/local/bin/actionlint
+          rm -f actionlint actionlint.tar.gz checksums.txt
+
+      # shellcheck ships on the runner, so actionlint also lints embedded `run:`
+      # scripts. -color for readable annotations in the job log.
+      - name: Run actionlint
+        run: actionlint -color