ci: defend the template repo, and stop it handing out stale action versions

[catomean]

dotfiles defines what "a defended branch" means for ~26 repos and had no
.github/ directory at all — the source of truth for every gate was the one
branch with no gate. It had also drifted: it still handed out
actions/checkout@v4 and setup-node@v4 sixteen days after fleetcrown and
orangecat moved to v7, so every fresh copy re-introduced the old versions.

Templates bumped to v7 to match what the fleet actually runs (verified against
fleetcrown and orangecat, not guessed).

The new workflow checks the four things that make this repo trustworthy:

• every .sh parses (install.sh is what lands on a new machine; a syntax error
  there surfaces at the worst possible moment)
• every CI template is valid YAML (a broken template fails far from here,
  inside whichever repo copied it)
• both templates still call npm run verify — the template's entire premise
  is that "verified" is defined once in package.json and CI calls it verbatim;
  if that quietly stops being true the premise is gone
• no template pins actions/checkout or setup-node below v7 — the exact drift
  this commit is fixing, now impossible to reintroduce silently

Each gate prints a positive count of what it scanned, so "0 scanned" can never
again look like "0 problems" — the failure mode that let fleetcrown's design
gate pass for its entire life while scanning nothing.

All four verified locally before pushing: 9 shell scripts parse, both
templates parse, verify SSOT present in both, no stale pins.

Co-Authored-By: Claude Fable 5 noreply@anthropic.com