Add local and CI validation for GitHub Actions workflows

### Description

Add actionlint to provide immediate validation when contributors edit GitHub Actions workflow files and consistent validation through the existing Integration workflow. Target local pre-commit checks to changed workflow files, while retaining universal CI validation as part of repository verification.

### Action Items

- [ ] Add actionlint to the mise-managed local toolchain with a reproducible version policy.
- [ ] Add a discoverable pnpm command to lint all GitHub Actions workflow files.
- [ ] Configure lint-staged/Husky so actionlint runs on staged files under .github/workflows/.
- [ ] Add workflow validation to the existing pnpm verification path used locally and by Integration CI.
- [ ] Ensure Integration’s workflow validation runs for every applicable pull request and protected-branch push.
- [ ] Verify invalid GitHub Actions syntax and expressions fail locally and in CI with actionable output.
- [ ] Document setup and troubleshooting for contributors.
- [ ] Confirm the implementation does not use path filters on the required Integration workflow.

### Additional Information

Local validation should be targeted to changed workflow files for fast feedback. CI should always validate workflows as part of pnpm verification because a path filter on the required Integration workflow would skip all code verification for non-workflow changes.

Related: #740 hardens the Integration workflow.