Add actionlint pre-commit hook for workflow validation

- Fix workflow to use github.* context vars (Forgejo schema validator
  only recognizes GitHub Actions syntax, not gitea.* aliases)
- Pass untrusted inputs through env vars (security best practice)
- Add actionlint to Brewfile and pre-commit config

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.pre-commit-config.yaml

@@ -80,3 +80,10 @@ repos:
       - id: prettier
         types_or: [json]
         args: ['--tab-width', '2']
+
+  # GitHub/Forgejo Actions workflow linting
+  - repo: https://github.com/rhysd/actionlint
+    rev: v1.7.10
+    hooks:
+      - id: actionlint-system
+        files: ^\.forgejo/workflows/