fix(actionlint): use github.workflow_ref (not workflow_sha) for cross-repo checkout

[blairham]

Summary

validate-reusable-inputs vendors pinpredict/.github at the workflow's own ref so that uses: ./<vendored> resolves against this repo rather than the caller. The previous revision (commit 73a31ca) used ref: \${{ github.workflow_sha }}, on the assumption that workflow_sha is "the @ref SHA when invoked from a downstream caller." It isn't — in cross-repo reusable calls, github.workflow_sha returns the caller's head SHA, so actions/checkout fails with not our ref <caller-sha> when trying to fetch it from pinpredict/.github.

Switch to parsing github.workflow_ref. Shape:

<owner>/<repo>/.github/workflows/<file>.yml@<git-ref>

Splitting on @ yields a ref actions/checkout resolves against this repo — refs/heads/main for downstream @main callers, refs/pull/N/merge for self-CI PRs, a SHA when pinned.

Observed impact

Live failures since 73a31ca rolled out (2026-06-08):

• trading-reports main — every CI run since feat: add language-setup composite actions #4 merged.
• service-template PR ci(pre-commit): seed hook-env cache on push to default branch #12 — first PR run since the actionlint shim landed.
• Any other consumer that has run since the rollout.

Test plan

• Self-CI on this PR passes (proves the fix doesn't break the self-CI path).
• After merge, re-run CI on `trading-reports#5` and `service-template#12` — both should go green on `validate-reusable-inputs`.

🤖 Generated with Claude Code