Nothing runs actionlint — a structural workflow defect lands as a job-less red on a consuming repo #3228

The gap

CI validates workflows in several ways — check-workflow-timeouts.py caps every job, the shared-rule
check, the pin guards — but nothing runs actionlint, and no check catches a structural defect
in a workflow file.

What it cost, measured today

#3225 inserted an input between the previous input's required: line and its default: line. The
orphaned default attached to the new input, producing a duplicate default key, and the input
above silently lost its default. GitHub refuses the whole workflow.

The failure surfaced in a different repository: MeshWeaver.Plugins#1268 run 33777768374
concluded failure with zero jobs and zero contexts. A startup_failure renders as an ordinary
red and names nothing — no job to open, no log to read, no annotation on the commit. Attributing it
took comparing job counts across two heads in two repos (the prior head ran 29 jobs; this one ran 0)
and then linting the lane by hand.

actionlint names it in one line, at the source:

.github/workflows/node-repo-module-pack.yml:289:9: key "default" is duplicated in input of
workflow_call event. previously defined at line:288,col:9 [syntax-check]

🚨 And the verification that "passed" could not have failed. #3225 validated the lane with
yaml.safe_load; PyYAML accepts duplicate mapping keys and silently keeps the last, so the parse
succeeded, the input's spec read back correctly, and an "unchanged required inputs" assertion passed.
Any workflow validation built on a permissive YAML load has this blind spot by construction.

Why it is worse for THIS repo than for most

These are workflow_call lanes five satellite repos pin. A structural break in one is invisible in
core — core does not call them — and lands as a job-less red on whichever satellite pins the new sha
first. The blast radius is every consumer, and the diagnosis happens furthest from the cause.

What to add

Run actionlint over .github/workflows/ in the existing workflow-validation job, failing on any
finding. Notes:

• It is a single static binary; no runtime deps.
• Start with -shellcheck= -pyflakes= (disable the embedded shell/python linters) so the change is
  about workflow structure only and does not arrive with a large backlog of run: findings. Those
  can be enabled later, deliberately.
• Measured now: the repo is clean under that configuration — zero duplicate-key findings across
  every workflow after Restore always-modules' default — #3225 orphaned it onto the new input and startup-failed every caller #3226. So this arrives green rather than with a backlog to triage.
• The node-repo lanes are the highest-value targets, but run it over all of them; the cost is
  seconds.

Filed rather than folded into #3226, which restores one line and should stay reviewable as such.