Add validate workflow and actionlint hook

Lint-only pipeline: run pre-commit on push to main; no build needed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016TPnPhJbaFEWFLgY6e9WbH

.gitea/workflows/validate.yml

@@ -0,0 +1,24 @@
+name: Validate actions
+
+# Lint-only workflow: this repo holds reusable composite actions, so there is
+# nothing to build — validation via pre-commit is the whole pipeline.
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  validate:
+    runs-on:
+      - linux
+      - build
+      - amd64
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Run pre-commit hooks
+        run: |
+          set -euo pipefail
+          pre-commit run --all-files --show-diff-on-failure

.pre-commit-config.yaml

@@ -19,3 +19,10 @@ repos:
     hooks:
       - id: detect-secrets
         args: [ "--baseline", ".secrets.baseline" ]
+
+  - repo: https://github.com/rhysd/actionlint
+    rev: v1.7.7
+    hooks:
+      - id: actionlint
+        args: [ "-config-file", "actionlint.yaml" ]
+        files: ^\.gitea/workflows/.*\.ya?ml$

actionlint.yaml

@@ -0,0 +1,6 @@
+self-hosted-runner:
+  labels:
+    - linux
+    - build
+    - amd64
+    - arm64