ci: validate published workflow templates

[charliedowler]

Summary

• add an explicit actionlint CI gate for all six root-level workflow templates
• add Renovate coverage for GitHub Actions references in those templates
• retain the existing template behaviour while baselining existing ShellCheck style advisories

Validation

• ran actionlint directly against all six explicit template paths using the CI arguments
• temporarily added an invalid actions/setup-node input and confirmed actionlint failed, then restored the template unchanged
• ran renovate-config-validator --strict --no-global renovate.json successfully

Tracked validity error

• on its first run, actionlint found a real validity error in the published close-preview.yml template: merged is not a valid pull_request activity type
• this is tracked in PROD-10126 and is suppressed only to keep this validation-infrastructure PR scoped; the suppression must be removed with that fix

Linear: PROD-10125