feat: add CI guard for stale workflow lock files on PRs

[Copilot]

Workflow markdown edits were landing on main without regenerated .lock.yml artifacts because the only drift check (check-workflow-drift in ci.yml) runs post-merge on push to main, not on PRs.

Changes

• .github/workflows/lock-file-guard.yml — new workflow triggered on pull_request whenever .github/workflows/*.md files change; runs make check-stale-lock-files (the existing fast git-based guard that requires no binary) and fails with a make recompile remediation message if any markdown was edited without a corresponding .lock.yml update

The underlying script (scripts/check-stale-lock-files.sh) and Makefile target already existed and auto-detect GITHUB_BASE_REF for accurate PR diff scoping. This PR wires them into the PR gate.

[github-actions]

Hey @app/copilot-swe-agent 👋 — thanks for adding the CI guard for stale workflow lock files! The PR is well-described and focused. One thing to consider:

• Tests — no test files were found in the diff. If there are test scripts or integration tests that can validate this new workflow guard (e.g., a script that verifies check-stale-lock-files.sh catches stale files), adding them would strengthen the PR.

Otherwise, this looks ready for review — the existing scripts it wires up were already tested separately.

If you'd like a hand, you can assign this prompt to your coding agent:

Add a test for the lock-file-guard workflow: create a shell test script under scripts/ (or tests/) that:
1. Creates a dummy .github/workflows/*.md file without a corresponding .lock.yml
2. Runs scripts/check-stale-lock-files.sh
3. Asserts the script exits non-zero (detecting the stale state)
4. Cleans up temp files
This validates the guard logic outside of a live GitHub Actions run.

Generated by ✅ Contribution Check · 102.8 AIC · ⌖ 8.82 AIC · ⊞ 6.2K · ◷