feat: native github-actions check

[staff0rd]

What

Adds a recommended github-actions check, run by verifyx all and preselected by verifyx init. It validates workflows and action metadata against vendored SchemaStore schemas and fails trigger paths/paths-ignore globs that match no file. Each problem prints file:line:col and the failing rule.

Why

An invalid timeout-minutes key on a composite action step stopped the runner loading the action, and no check caught it. The @action-validator/cli workaround is stale on npm, POSIX-only and GPL-3.0.

How

Validation is ajv against the Apache-2.0 SchemaStore schemas shipped in schemas/, so it needs no network at runtime. npm run schemas:refresh updates them. Repos with workflows that break the schema will start failing when they upgrade.

[staff0rd]

Code review summary

Findings: 2 (blocker 0, major 1, minor 1, nit 0)

The schema-validation part of the new github-actions check is solid. The vendored schemas resolve from both src/ and dist/, ajv compiles them, and the tests check exact error output. The main risk is the custom GitHub glob translator in githubPathFilter.ts. It does not let **/ match zero directories, so common, valid path filters are reported as dead. Because the check is recommended and runs in verifyx all, this would fail CI on correct workflows. A smaller issue: negated globs are checked against the wrong file set, which lets some negations that exclude nothing go unreported.

Findings

• major: **/ cannot match zero directories, so valid path filters are reported as dead
• minor: Each negated glob is checked against all earlier positive matches instead of the files still included