[autonomy-atomicity] Makefile actionlint whitelist leaves internal workflows unvalidated

## Autonomy / Atomicity Findings

### 1. Central actionlint whitelist skips internal workflows
**Category:** Manual routing / Config hotspot
**File(s):** `Makefile`, `.github/workflows/ci.yml`, `.github/workflows/*.yml`

**Problem:**
The CI lint job runs `make lint-workflows` (`.github/workflows/ci.yml:9-17`), but the Makefile target uses a hand-maintained allowlist instead of linting all workflow YAML sources. `Makefile:227-240` currently includes only:

- `claude-workflows/**/example.yml` / `example.yaml`
- `.github/workflows/trigger-*.yml` / `trigger-*.yaml`
- `.github/workflows/ci.yml`
- `.github/workflows/release.yml`
- `.github/workflows/smoke-test-install.yml`

That leaves these non-lock workflow files outside actionlint coverage today:

- `.github/workflows/agentics-maintenance.yml`
- `.github/workflows/ci-tests.yml`
- `.github/workflows/claude-mention-in-issue.yml`
- `.github/workflows/claude-mention-in-pr.yml`
- `.github/workflows/minimize-resolved-pr-reviews.yml`
- `.github/workflows/mkdocs.yml`

When multiple agents or developers add or modify unrelated internal workflows, each change must also remember to update the same central Makefile whitelist. If they do not, CI still reports workflow lint success while the new or changed workflow is never checked by actionlint. This creates both a merge-conflict hotspot and an implicit validation gap.

**Duplicate check:** Open issue `#796` covers adding `gh-agent-workflows/*/example.yml` templates to actionlint. This finding is distinct: it covers `.github/workflows/*.yml` internal workflow files that already live in the CI workflow directory but are skipped unless manually named.

**Suggested fix:**
Replace the hard-coded internal workflow names with a discovery rule such as linting all `.github/workflows/*.yml` / `.yaml` except generated `*.lock.yml`, plus a short documented exclusion list only for files that truly cannot be actionlinted. That lets new internal workflows receive validation automatically without touching a shared registry.

## Suggested Actions
- [ ] Update `Makefile:227-240` so `lint-workflows` discovers all non-lock `.github/workflows/*.yml` / `.yaml` files automatically.
- [ ] Keep any necessary exclusions explicit and documented next to the lint discovery rule.
- [ ] Confirm the CI `lint-workflows` job validates the currently skipped internal workflows listed above.

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Trigger Autonomy Atomicity Analyzer](https://github.com/elastic/ai-github-actions/actions/runs/27706298991)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

Inspect Makefile:227-240 and the lint-workflows job in .github/workflows/ci.yml:9-17. Start by running make lint-workflows and reviewing the listed .github/workflows/*.yml and *.yaml files, including the currently skipped internal workflows. Update discovery and document any exclusions so the command validates all non-lock workflow files.

Written by the indexing model from the issue text.