feat(actionlint): cross-repo input validation for reusable workflows

[blairham]

Summary

• New composite action actions/validate-reusable-inputs/ that diffs each caller with: block against the referenced pinpredict/.github reusable workflow's on.workflow_call.inputs map. Fails on unknown keys (with a did-you-mean hint) or missing required keys.
• Wired as a sibling job in .github/workflows/actionlint.yml so every consumer that already uses: the central actionlint workflow (service-template's ci.yml + everything inheriting it) picks up the gate automatically.
• README updated under ### Composite actions.

Closes pinpredict/platform-gitops#1045.

Why

Stock actionlint (wired in #944) only validates the local side of workflow_call contracts. It can't fetch remote reusable workflows, so a caller passing a removed or renamed with: key to pinpredict/.github/.github/workflows/<x>.yml@<ref> still surfaces only at runtime as startup_failure. The platform-gitops#1045 issue picked path B (custom action that fetches + diffs) — this PR implements it in ~120 lines of Python.

Behavior verified locally

• Clean pass on self-CI (pinpredict/.github): 5 workflow file(s) scanned, all caller with: blocks match.
• Clean pass on service-template: 2 workflow file(s) scanned, all caller with: blocks match (validates the real matrix: input on docker-release.yml@main).
• Negative test (deliberately broken with: block):

  - job `release` passes unknown input `bogus_flag` to ...docker-release.yml@main (did you mean `matrix`?)
  - job `release` passes unknown input `matrixx` to ...docker-release.yml@main (did you mean `matrix`?)
  - job `release` is missing required input `matrix` for ...docker-release.yml@main
  exit=1
  

Test plan

• Self-CI on this PR: actionlint job passes. The validate-reusable-inputs job will fail on this PR only — the composite action it uses: ...@main doesn't exist on main yet (chicken-and-egg with org-default action releases). Override required-checks for this PR; subsequent PRs pass cleanly.
• Post-merge: open a throwaway PR in service-template that adds a bogus with: key on the actionlint uses: line; confirm CI fails on the caller with a useful message.
• Post-merge: confirm a clean PR in service-template still goes green.

Open question (call out in review)

The action runs in the caller's job context, so it uses the caller's GITHUB_TOKEN. That token has contents: read on the caller's own repo but not necessarily on pinpredict/.github. If gh api fails on cross-repo reads in real callers, we'll need either (a) pinpredict/.github to be readable org-wide, or (b) a PAT/App token passed via github-token. The action already exposes the input — wiring is a one-line follow-up.

🤖 Generated with Claude Code