Add CI to cover the workflows this repo publishes #21

Twelve repos depend on these workflows, and nothing checks them before they reach master. Four bugs shipped that way, three of which let a guard pass silently:

• check-workflow-status matches runs of every workflow, not the one named #19 — the status check matched every workflow in the repo
• check-tag-version-equality passes unconditionally when no tag is reachable #16 — the tag comparison fell back to v0.0.0 on a shallow clone
• an unknown workflow-status returned an empty list, so a typo passed the guard
• build-image and tag-image resolve version-sha from a moving ref #18 — build-image and tag-image resolved a moving tag

Worth adding:

• actionlint over .github/workflows. It covers syntax, expressions and action inputs across all twelve files with no custom code. Run against master it already reports fast-forward reads an input it never declares #22 and Two workflows still run actions/github-script@v6 on retired Node 16 #23, so those land first. Start with -shellcheck=, since shellcheck adds quoting findings across most of the workflows and deserves its own pass.
• Unit tests for check-workflow-status.yml, the one file carrying real logic. Read the script block out of the YAML and run it against mocked octokit responses under node --test.
• A check that GitHub still accepts each status value this repo sends. That one needs the live API, so a scheduled run suits it better than a per-PR job.

#20 added the package.json, the pull-request workflow and tests for check-workflow-status.yml, so that part is done. What remains here is actionlint and the scheduled live-API check.