ci: scan shared workflow changes

[altaywtf]

Problem

Changes to the shared scan workflow had no in-repository caller, so this repository did not exercise its own reusable contract in CI. Local workflow linting was also ad hoc.

Solution

Add a thin relative self-caller that runs the reusable workflow at the pull request exact revision. Add a source-aware Mise gate for pinned Actionlint and Zizmor, and encode the existing intentional Zizmor argument split for ShellCheck without changing scanner behavior or first-party ref policy.

Proof

• Forced local gate: 0.80s.
• Unchanged local gate: 0.19s.
• Actionlint 1.7.12 and Zizmor 1.29.0 pass both workflows with no Zizmor findings.

[Copilot]

Pull request overview

This PR adds a repository-local way to exercise the shared reusable scan workflow in CI, and introduces a consistent local verification gate (via Mise) for workflow linting/security auditing.

Changes:

• Add a self-caller workflow (self-scan.yml) that runs the repo’s reusable scan workflow on pushes, PRs, schedules, and manual dispatch.
• Add mise.toml with pinned actionlint and zizmor plus mise run verify tasks for local workflow verification.
• Clarify intentional ShellCheck behavior in the reusable scan workflow by suppressing SC2086 for the deliberate argument word-splitting.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
README.md	Documents how to run local verification via Mise and what the self-caller does.
mise.toml	Adds pinned tooling and local verification tasks for workflow linting/auditing.
.github/workflows/self-scan.yml	Introduces a thin caller workflow to run the reusable scan workflow from this repo.
.github/workflows/scan.yml	Adds a ShellCheck suppression comment to preserve intentional argument splitting behavior.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[slopzapper]

✨ CLEAN

The self-caller uses the supported same-commit reusable workflow form, and the mise verify path matches documented freshness and --force behavior. No introduced defect on the eligible paths.