Add validate workflow and actionlint hook

Lint-only pipeline: run pre-commit on push to main; no build needed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016TPnPhJbaFEWFLgY6e9WbH

actionlint.yaml

@@ -0,0 +1,6 @@
+self-hosted-runner:
+  labels:
+    - linux
+    - build
+    - amd64
+    - arm64