fix(ci): lint generated workflow snapshots directly

[max-sixty]

The generated-workflow gate copied actionlint's ShellCheck preprocessing, exclusions, and severity into Python. That duplicate could drift from the pinned binary, and its regression test still passed if severity fell back to warning.

Run the pinned actionlint hook directly over all 36 complete workflow snapshots instead. Pytest keeps those snapshots synchronized with the generator, while a command-scoped ignore suppresses only actionlint's known concurrency.queue schema mismatch. The existing composite-action ShellCheck coverage remains unchanged.

Validation: wt test (882 Python tests, 32 worker tests, TypeScript typecheck), pre-commit run --all-files, and the historical notification snapshot fails the new hook with SC2016:info.

This was written by Codex on behalf of max-sixty

[tend-agent]

One thing on the new gate: the swap trades a coupling that fails loudly for one that fails silently. test_generated_run_bodies_pass_shellcheck called generate_all() directly, so a generator that produced nothing broke the test. The hook is coupled instead to the pytest module name baked into the snapshot filenames, and pre-commit treats a files:-unmatched hook as Skipped with exit 0 — a rename or split of test_generate.py retires the gate without turning anything red. Inline suggestion adds a parity check.

Nothing else stood out — the coverage is genuinely wider than what it replaces (all 36 snapshots across both harnesses rather than one synthetic config, at actionlint's own default severity), the GENERATORS parametrization on the regtests keeps a new workflow from arriving unlinted, and the command-scoped -ignore is the right call given .github/actionlint.yaml scopes its ignore to **/.github/workflows/tend-*.yaml, which these paths don't match.