GRM-51: ci: add actionlint and act_runner exec for workflow verification

Makefile

@@ -1,4 +1,4 @@
-.PHONY: all setup install update lint ansible-lint makefile-lint lint-all test test-unit pytest-cov molecule molecule-all test-all clean
+.PHONY: all setup install update lint ansible-lint makefile-lint lint-all test test-unit pytest-cov molecule molecule-all test-all clean workflow-lint workflow-dryrun workflow-check
 
 PYTHON := python3
 VENV := .venv
@@ -86,7 +86,22 @@ ansible-lint:
 makefile-lint:
 	@$(CHECKMAKE) Makefile
 
-lint-all: lint ansible-lint makefile-lint
+lint-all: lint ansible-lint makefile-lint workflow-lint
+
+workflow-lint:
+	@command -v actionlint >/dev/null 2>&1 || { \
+		echo "actionlint not found. Install: bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)"; \
+		exit 1; \
+	}
+	actionlint -config-file .gitea/actionlint.yaml .gitea/workflows/*.yml
+
+workflow-dryrun:
+	@command -v act_runner >/dev/null 2>&1 || { echo "act_runner not found. Install: https://gitea.com/gitea/act_runner/releases"; exit 1; }
+	@echo "Dry-running all workflows (no Docker containers started)..."
+	act_runner exec --dryrun -W .gitea/workflows/ 2>&1 | grep -E 'DRYRUN|ERROR|FAIL|Job'
+
+workflow-check: workflow-lint workflow-dryrun
+	@echo "Workflow checks passed (static lint + dry-run)."
 
 test-unit:
 	$(BIN)/pytest tests/unit/ -v --no-cov