[bug-hunter] setup-action-validator skips reinstall for non-executable existing binary

## Impact
Developers following the documented local workflow (`make setup` then `make lint`) can hit a deterministic failure if `bin/action-validator` exists but is not executable (for example, interrupted install or stale file). `setup-action-validator` treats the file as already installed and does not repair it, then `lint-actions` fails with `Permission denied`.

## Reproduction Steps
1. Create and run this new minimal reproduction script from the repository root:
```bash
mkdir -p /tmp/gh-aw/agent
cat <<'SCRIPT' > /tmp/gh-aw/agent/repro_action_validator_bug.sh
#!/usr/bin/env bash
set -euo pipefail
cd /home/runner/work/ai-github-actions/ai-github-actions

backup=""
if [ -e bin/action-validator ]; then
backup="/tmp/gh-aw/agent/action-validator.backup.$RANDOM"
cp -p bin/action-validator "$backup"
fi
cleanup() {
rm -f bin/action-validator
if [ -n "${backup}" ] && [ -e "$backup" ]; then
mv "$backup" bin/action-validator
fi
}
trap cleanup EXIT

mkdir -p bin
printf 'broken-binary' > bin/action-validator
chmod 0644 bin/action-validator

echo '--- make setup-action-validator ---'
make setup-action-validator || true

echo '--- make lint-actions ---'
set +e
make lint-actions
status=$?
set -e

echo "EXIT_STATUS=$status"
SCRIPT
chmod +x /tmp/gh-aw/agent/repro_action_validator_bug.sh
/tmp/gh-aw/agent/repro_action_validator_bug.sh
```

## Expected vs Actual
**Expected:** `make setup-action-validator` should detect an unusable existing binary and reinstall/fix permissions so `make lint-actions` can run.

**Actual:** setup reports "already installed" based only on file existence, then `lint-actions` fails:

```text
--- make setup-action-validator ---
Setting up action-validator...
✓ action-validator already installed: /bin/sh: 4: bin/action-validator: Permission denied
--- make lint-actions ---
Setting up action-validator...
✓ action-validator already installed: /bin/sh: 4: bin/action-validator: Permission denied
Validating GitHub Actions composite action files...
Checking claude-workflows/mention-in-issue/rwxp/action.yml...
/bin/sh: 4: bin/action-validator: Permission denied
make: *** [Makefile:271: lint-actions] Error 1
EXIT_STATUS=2
```

## Failing Test
```bash
#!/usr/bin/env bash
set -euo pipefail
cd /home/runner/work/ai-github-actions/ai-github-actions

backup=""
if [ -e bin/action-validator ]; then
backup="/tmp/gh-aw/agent/action-validator.backup.$RANDOM"
cp -p bin/action-validator "$backup"
fi
cleanup() {
rm -f bin/action-validator
if [ -n "${backup}" ] && [ -e "$backup" ]; then
mv "$backup" bin/action-validator
fi
}
trap cleanup EXIT

mkdir -p bin
printf 'broken-binary' > bin/action-validator
chmod 0644 bin/action-validator

make setup-action-validator || true
make lint-actions
```

## Evidence
- `Makefile:258-260` checks only `-f` and then executes `bin/action-validator --version` in the "already installed" path.
- `Makefile:269-275` always invokes `bin/action-validator` for `lint-actions`.
- `DEVELOPING.md:28-30` documents `make setup` then `make lint` as the standard path.

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Trigger Bug Hunter](https://github.com/elastic/ai-github-actions/actions/runs/34470431357)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
> - [x] expires on Sep 17, 2026, 11:27 AM UTC

Start with Makefile lines 258-260, where setup-action-validator checks the existing binary, and lines 269-275 for lint-actions; DEVELOPING.md lines 28-30 shows the documented workflow. Run the reproduction script from the issue, then verify that make setup-action-validator handles a non-executable bin/action-validator and make lint-actions completes successfully.

Written by the indexing model from the issue text.