ci: lint workflow files with actionlint

Add a dedicated workflow that runs actionlint on `.github/workflows/**`.
It catches what plain YAML validity doesn't — undefined `needs`/job
references, malformed `${{ }}` expressions, unknown action inputs, and
(via shellcheck) issues in `run:` scripts. A dead `needs:` reference
previously shipped because nothing guarded the workflows themselves.

Author: loss-and-quick

.github/workflows/lint-workflows.yml

@@ -0,0 +1,33 @@
+name: Lint Workflows
+
+# Lint the workflow files themselves. actionlint catches what YAML validity can't:
+# undefined `needs`/job references, bad `${{ }}` expressions, unknown action inputs,
+# and (via its shellcheck integration) shell issues in `run:` blocks. A broken
+# `needs:` reference once shipped silently because nothing here guarded it.
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/**'
+  push:
+    branches: [main]
+    paths:
+      - '.github/workflows/**'
+
+permissions:
+  contents: read
+
+jobs:
+  actionlint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - name: Install actionlint
+        uses: taiki-e/install-action@15449e3094499af05d8d964a1c884208e4b8b595 # v2
+        with:
+          tool: actionlint
+
+      # shellcheck ships on the runner, so actionlint also lints embedded `run:`
+      # scripts. -color for readable annotations in the job log.
+      - name: Run actionlint
+        run: actionlint -color