feat(build): provision workflow tools from selected gates

[slepp]

Summary

Depends on #2887 and should merge after it.

Selected workflow gates now declare actionlint and act, and shared setup installs the pinned tools on supported hosts. Workflow lint covers both workflows and local actions, while local workflow discovery uses the same gate-derived provisioning. Review the split between action-installed tools and Go-installed tools across hosted and FreeBSD setup.

Verification

• cargo test --workspace --no-run: workspace test targets compile
• cargo xtask tools --verify workflow-lint,workflow-local: both pinned tools resolve and verify
• cargo xtask gate workflow-lint: workflows and local actions pass actionlint
• cargo xtask ci-local --list: the local workflow job is discovered through act

Out of scope

• The local Linux workflow is listed but not executed as a containerized job on macOS.

[slepp]

This remains blocked on #2887. Its own first deterministic failure is gate reachability: make workflow-lint is reached by no CI workflow step. It should not land independently; if this provisioning work is retained, it needs a fresh base after the #2887 decision and an explicit CI edge for workflow lint.