Add actionlint/yamllint schema check for plugins/**/*.yaml composite actions

[nsheaps]

Context

During PR #340, plugins/claude-code/review-utils/actions/run-agent/action.yaml was accidentally corrupted into a base64-encoded blob (twice — see ff846e8 and c86f5424, both flagged by henry-nsheaps[bot]'s review). The existing mise run lint pipeline (Prettier-check + tsc --noEmit + shell-syntax + plugin validate) did not catch either corruption, because a base64 blob is itself a technically valid YAML scalar document — yaml.safe_load() succeeds, it just returns a string instead of the expected mapping.

Proposal

Add actionlint (schema-aware, validates runs.using/runs.steps[*].uses|run for composite actions) or a yamllint rule requiring a mapping at the document root, scoped to plugins/**/*.yaml. Either would have caught both corruption commits before merge, since a single-scalar document fails a composite-action schema check even though it parses as valid YAML.

Acceptance criteria

• Lint step added to mise run lint (or equivalent CI job) covering plugins/**/*.yaml
• Verified to reject a single-scalar YAML document (regression test using a base64-blob fixture)
• Verified to pass on all existing plugins/**/*.yaml composite actions

References

• PR: fix(review-utils): grant Read in dispatch pipeline's allowedTools #340
• Henry's reviews flagging this: fix(review-utils): grant Read in dispatch pipeline's allowedTools #340 (review), fix(review-utils): grant Read in dispatch pipeline's allowedTools #340 (review)