GitHub Actions workflows are linted for syntax and schema errors

## Summary

Add `actionlint` to pre-commit and drop the `check-yaml` exclusion for
`.github/workflows/`, so workflow files get the same gate as everything else in
the tree.

## Motivation

`.pre-commit-config.yaml:23` excludes `^\.github/workflows/` from `check-yaml`,
and there is no `actionlint` hook. The five workflow files therefore have
neither a YAML syntax gate nor an Actions schema gate — the only thing that
catches a mistake in them is a workflow failing to run, or running wrong.

They are also the files Renovate edits most often: action digests via
`helpers:pinGitHubActionDigests`, and the `FOURMOLU_VERSION` / `HLINT_VERSION`
strings via the `customManagers:githubActionsVersions` regex in
`pre-commit.yml`. A malformed edit there surfaces as a workflow that silently
stops running rather than as a red check.

All five workflows parse cleanly under PyYAML today, so the exclusion looks like
carried-over boilerplate from #131 (which introduced it) rather than a live
workaround — worth confirming while fixing. alunduil-chezmoi runs `actionlint`
at `rev: v1.7.12` alongside an unexcluded `check-yaml`.

## Scope

- Add the `rhysd/actionlint` hook to `.pre-commit-config.yaml`.
- Drop `exclude: '^\.github/workflows/'` from `check-yaml`. If it turns out to
be load-bearing, keep it and add a comment saying why.
- Fix what the first `actionlint` run surfaces, or track the remainder in a
follow-up.

## Acceptance criteria

- [ ] `actionlint` runs over `.github/workflows/` through pre-commit.
- [ ] `check-yaml` covers `.github/workflows/`, or the exclusion carries a
comment justifying it.
- [ ] `pre-commit run --all-files` is clean.
- [ ] A deliberately malformed workflow fails the `Hooks` job.

## Additional context

Surfaced by a CI and checks audit. Pairs with #165: a required status check is
worth more when the workflow defining it is itself linted.