Add validate workflow and actionlint hook

Lint-only pipeline: run pre-commit on push to main; no build needed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016TPnPhJbaFEWFLgY6e9WbH

.pre-commit-config.yaml

@@ -19,3 +19,10 @@ repos:
     hooks:
       - id: detect-secrets
         args: [ "--baseline", ".secrets.baseline" ]
+
+  - repo: https://github.com/rhysd/actionlint
+    rev: v1.7.7
+    hooks:
+      - id: actionlint
+        args: [ "-config-file", "actionlint.yaml" ]
+        files: ^\.gitea/workflows/.*\.ya?ml$