ci: harden validation workflows

[lalalune]

Summary

• make the whitespace fixer portable across GNU/Linux and macOS and safe for unusual paths
• normalize existing whitespace failures on main
• make the optional AI PR summary succeed when OPENROUTER_KEY is unavailable
• remove an untrusted branch-name shell interpolation from CI

Validation

• actionlint .github/workflows/*.yml
• bash -n scripts/lintWhitespace.sh
• bash scripts/lintWhitespace.sh
• git diff --check

This must land on main before PR #503 can consume the repaired pull_request_target workflow.