- Fix workflow to use github.* context vars (Forgejo schema validator
only recognizes GitHub Actions syntax, not gitea.* aliases)
- Pass untrusted inputs through env vars (security best practice)
- Add actionlint to Brewfile and pre-commit config
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>