ci(scripts): add check-workflow-templates.sh guard for bundled workflow templates

[laurigates]

Groundwork for the dynamic-workflow migration. Required by .claude/rules/regression-testing.md — several of the planned templates encode bug fixes, and none is currently guarded.

Source: docs/plans/dynamic-workflow-migration.md §Repo-level consequences, item 4 (merged in #2162).

Scope

scripts/check-workflow-templates.sh + scripts/tests/test-check-workflow-templates.sh, wired into pre-commit and the plugin PR-checks workflow. Follows the === HEADER === / KEY=VALUE / STATUS= convention in .claude/rules/structured-script-output.md.

Checks

1. Every workflows/*.js is reachable. Its sibling SKILL.md has a ## Workflow harness (template) section referencing it, and that section contains the literal string not a script to run verbatim. An orphan .js fails.
2. Worktree templates carry the resume warning. Any template containing isolation:'worktree' also contains #1868. Mirrors the existing pin at check-agent-failure-contract.sh:124-125.
3. cold-read-gate/SKILL.md retains run_in_background: false and #2063. The feedback(agent-patterns-plugin): cold-read-gate should specify synchronous execution + how to retrieve the reader's critique #2063 fix currently has no check of its own — the batch template's verdict enum is the second fix to the same bug class, so the guard is overdue independently of whether that template ships.
4. execution-grounded-review/SKILL.md retains the literal token loop-integrity.md. Already required by check-loop-integrity.sh:74 — worth noting in that skill's delta so a later "tighten the Related section" edit does not fail the build.

Ordering note

Check 3 is worth landing even if the cold-read-gate batch template never ships (it is the weakest Tier B candidate). The #2063 guard gap is real today.

Acceptance

• scripts/check-workflow-templates.sh implements checks 1–4, emits STATUS=
• scripts/tests/test-check-workflow-templates.sh covers pass and fail for each check
• Wired into .pre-commit-config.yaml and the PR-checks workflow, path-filtered to **/workflows/*.js and **/SKILL.md
• Passes against the repo as it stands (zero templates = vacuously green)

Blocked by the layout convention landing first (## Workflow harness (template) is the string it greps for).