[product-manager-impersonator] Secret contract parity lint for reusable workflows

## Feature Idea

**Summary:** Add a lint check that keeps `workflow_call.secrets` contracts in sync across workflow source, compiled lock files, examples, and docs.

## Why a Customer Would Want This
Downstream teams rely on reusable workflow secret contracts to wire tokens correctly (especially when they need label events to trigger follow-up workflows). When secret declarations drift between source/docs/examples, users get confusing setup failures and have to debug internals.

## Rough Implementation Sketch
- Add `scripts/check-workflow-secret-contracts.py` to parse `.github/workflows/gh-aw-*.md` and extract `workflow_call.secrets`.
- For each workflow, compare against expected secret usage/declaration surfaces: `.github/workflows/gh-aw-*.lock.yml`, `gh-agent-workflows/*/example.yml`, and `gh-agent-workflows/*/README.md` (plus docs page where present).
- Fail with actionable per-workflow diffs (missing secret, undocumented secret, example mismatch).
- Wire the check into `make lint` and `.github/workflows/ci.yml` as a dedicated validation step.

## Why It Won't Be That Hard
The repo already uses custom Python lint scripts and CI jobs for repository consistency checks, so this is an incremental extension of existing patterns rather than a new subsystem.

## Evidence
- Current lint only runs workflow/action validators plus nav/catalog consistency (`Makefile` lines 243-244; `.github/workflows/ci.yml` lines 27-33), with no contract parity check.
- Development flow requires manual updates across multiple artifacts (`gh-agent-workflows/DEVELOPING.md` lines 145-161), which is where drift risk appears.
- Recent recurring fixes indicate this pain repeats across workflows: PRs #1012, #1026, #1027, #1030 (token/secret contract and related wiring updates).
- Concrete current inconsistency surface to catch early: `gh-aw-issue-fixer` source defines only `COPILOT_GITHUB_TOKEN` and `EXTRA_COMMIT_GITHUB_TOKEN` (`.github/workflows/gh-aw-issue-fixer.md` lines 55-59), while usage/docs/examples must stay aligned (`gh-agent-workflows/issue-fixer/example.yml` lines 15-18; `gh-agent-workflows/issue-fixer/README.md` lines 25-37).

> [!NOTE]
>
> 🔒 Integrity filter blocked 59 items
>
> The following items were blocked because they don't meet the GitHub integrity level.
>
> - [#937](https://github.com/elastic/ai-github-actions/pull/937) `search_pull_requests`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#359](https://github.com/elastic/ai-github-actions/issues/359) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#1067](https://github.com/elastic/ai-github-actions/issues/1067) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - elastic/ai-github-actions#1067 `list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - elastic/ai-github-actions#1029 `list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - elastic/ai-github-actions#1024 `list_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#1025](https://github.com/elastic/ai-github-actions/issues/1025) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#1024](https://github.com/elastic/ai-github-actions/issues/1024) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#1010](https://github.com/elastic/ai-github-actions/issues/1010) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#20](https://github.com/elastic/ai-github-actions/issues/20) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#248](https://github.com/elastic/ai-github-actions/issues/248) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#875](https://github.com/elastic/ai-github-actions/issues/875) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#424](https://github.com/elastic/ai-github-actions/issues/424) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#76](https://github.com/elastic/ai-github-actions/issues/76) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#185](https://github.com/elastic/ai-github-actions/issues/185) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - [#272](https://github.com/elastic/ai-github-actions/issues/272) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
> - ... and 43 more items
>
> To allow these resources, lower `min-integrity` in your GitHub frontmatter:
>
> ```yaml
> tools:
> github:
> min-integrity: approved # merged | approved | unapproved | none
> ```
>
>

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Trigger Product Manager Impersonator](https://github.com/elastic/ai-github-actions/actions/runs/25430405786)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.