Add actionlint for GitHub Actions workflow validation

[fizyk]

Summary

Add actionlint to validate GitHub Actions workflow semantics.

Rationale

zizmor is planned for GitHub Actions security analysis. actionlint complements it by checking workflow syntax and GitHub Actions-specific semantics. Do not add yamllint for this purpose.

Affected areas

• .github/workflows/
• The repository pre-commit or CI configuration that runs workflow validation

Required changes

• Add actionlint to the repository tooling.
• Run actionlint for GitHub Actions workflows.
• Keep the workflow validation focused on GitHub Actions semantics.
• Keep zizmor as a separate security-analysis tool.

Acceptance criteria

• The repository runs actionlint against .github/workflows/.
• A workflow with an actionlint-detectable error fails the relevant local or CI check.
• The configuration does not introduce yamllint as the GitHub Actions workflow linter.
• The tooling documentation or configuration states how contributors run the check.

Requested by: @fizyk

Backlinks:

• PR Migrate to fizyk/actions-reuse/.github/workflows/shared-automerge 5.4 #951: Migrate dev environment to uv - closes #940 fizyk/pyramid_fullauth#951
• Review comment: Migrate dev environment to uv - closes #940 fizyk/pyramid_fullauth#951 (comment)

---

Copied from fizyk/pyramid_fullauth#953