fix(validation): lint workflows by explicit path

[pedropaulofb]

Summary

Fix the trusted final-state validator so that actionlint can validate workflow files from the isolated snapshot.

Problem

The validator intentionally copies the candidate repository without its .git directory. However, actionlint was invoked without explicit workflow paths and therefore attempted to discover a Git repository from /repo. This caused the final validation to fail with:

no project was found in any parent directories of "/repo"

Changes

• Added actionlint_command(snapshot) to construct the isolated Docker command.
• Passes explicit relative paths for all .yml and .yaml files under .github/workflows.
• Preserves the existing isolated execution controls:
  • no network access;
  • read-only filesystem;
  • dropped capabilities;
  • non-root user;
  • no .git mount.
• Added a regression test confirming that explicit workflow paths are included and .git is not mounted.

Validation

• python -m pytest -q scripts/tests/test_pr_automation.py — 96 passed.
• python -m pytest -q scripts/tests — 525 passed.
• git diff --check — passed.

Docker is not installed locally, so the actionlint container was not run on the developer machine. The GitHub Actions validation will execute it in the intended containerized environment.