fix(ci): repair the invalid service-refresh workflow, add actionlint

[jfrench9]

Summary

service-refresh.yml on main is an invalid workflow file, and has been since the first commit of #1139. Since prod.yml and staging.yml call it via workflow_call, and an invalid callee fails the caller, deploys are broken until this lands.

Both errors came from #1139. This fixes them and adds actionlint so the class cannot recur silently — the guard #1139 added for exactly this purpose caught neither.

Changes

The two errors — .github/workflows/service-refresh.yml

1. A comment inside the Compute refresh job timeout run: block contained the literal ${{ }} delimiters, while explaining that arithmetic isn't allowed inside them. The expression parser scans the entire run: body and has no concept of a shell comment, so an empty expression there invalidates the whole file. The comment about the bug was the bug.
2. timeout-minutes read a job output directly. Job outputs are always strings and timeout-minutes must be a number, so it needs fromJSON. The || 45 fallback didn't help — it yields a string too — and was unnecessary, since that job only runs when the collect job set the output.

Both are now covered by a comment saying why, including an explicit "do not write the delimiters in this block, not even in a comment."

Why it wasn't caught — tests/infrastructure/test_workflow_expressions.py, deleted

That test was added in #1139 to prevent this exact class of bug. It was a regex hunting for arithmetic operators, so it matched the empty ${{ }}, found no operators inside, and passed. The type error was never in its reach at all. It's deleted rather than extended: keeping a weaker duplicate of a real linter is the same duplicated-fact drift this series has been fixing.

The replacement — actionlint

• Added as a uv dev dependency (actionlint-py), so uv run actionlint works locally and in CI the same way cfn-lint does — no separate install step, no CI-only tool.
• just lint-actions added and wired into both test-code and test-all, so it runs wherever the rest of the gate runs. just lint-actions-shell for the noisy shellcheck-enabled variant.
• New CI step in test.yml alongside the CloudFormation lint.
• Verified it fails on both errors above and exits 0 once fixed — a guard that only ever passes is worth nothing, which is the lesson from the one it replaces.

The baseline — .github/actionlint.yaml

19 findings predate the linter. Fixing them isn't in scope for an urgent repair, so each is ignored with a stated reason: deliberately string-typed workflow_call toggles (service-refresh accepts both forms on purpose), org-level ACTIONS_TOKEN, type: keys on composite action inputs, the intentional empty tier choice in graph-asg-refresh.yml, and required-inputs-with-defaults. The file says explicitly that adding to that list is a decision needing the same justification, not a way to silence a new finding.

Confirmed by diffing normalized actionlint output between main and this branch: exactly the two errors disappear, nothing new appears (21 → 19).

shellcheck integration is off in the gate — dozens of pre-existing info-level SC2086 quoting notes across unrelated workflows would bury the errors that actually invalidate a file. Worth its own pass later.

Breaking Changes

None. No application code, schema, or API surface. One new dev-only dependency.

Testing

• just test-code — passed (ruff, format, basedpyright, cf-lint, and the new actionlint step).
• uv run actionlint -shellcheck= — exit 0 across all workflows and composite actions.
• Negative test: reintroduced both errors, confirmed actionlint reports them and exits 1; restored, confirmed exit 0.
• uv lock --check — clean.
• tests/infrastructure/ — 43 passed (the 21 test_userdata_refresh.py cases from refactor(graph): move container refresh onto the instance #1139 still pass; 22 CloudFormation).

Not verified: nothing here can be confirmed until main is fixed, since the proof is GitHub accepting the file. After merge, the absence of a new startup-failure run on the merge commit is the signal.