Make the lockstep check catch stale agreement and .yaml workflows

[jeremy]

Two holes in the check that shipped in #625. Neither is a live failure — all 15 workflows are .yml and all three linting steps sit at v2.11.1 — but both are the same shape as the drift the check exists to catch.

It globbed *.yml only. GitHub honours .yaml just as well, and a .yaml workflow running a linter this check never opened is precisely the invisible drift it was written for. Now scans both, and fails on an empty scan rather than passing a check that opened no files.

It enforced agreement, not currency. Verified: setting all three workflows to v2.9.0 passes cleanly and reproduces the release failure that motivated #625 — a gosec G115 false positive that blocked a tag after every PR check had gone green. So there is now a floor, MIN_VERSION, next to WORKFLOW_DIR, commented to say that raising it is deliberate and must happen in the same commit as the pins it constrains.

Compared with sort -V, and that is the point, not a detail. As strings v2.9.0 sorts abovev2.11.1 because 9 > 1, so a lexical test would wave through the exact version that broke the release tag; [ -gt ] parses neither. aur-publish.yml's pkgrel guard carries the same note for the same reason.

Existing shape is untouched: the awk step-window parser, the UNPINNED failure mode added after the bot's find on #625, and the error output that names offending files.

Verification

Ran the script directly in each state, asserting exit codes and restoring the tree between:

State	Expect	Got
uniform v2.11.1 (today's tree)	pass	0 — "3 steps across 15 workflows"
uniform v2.9.0	fail, floor	1 — floor message
uniform v2.12.0	pass	0 — sort -V sanity above the floor
drift (one workflow differs)	fail	1 — disagree message
step with no version:	fail	1 — UNPINNED
.yaml fixture with a matching pin	counted	0 — 4 steps across 16 workflows
.yaml fixture with a drifted pin	fail	1 — names the .yaml file
.yaml fixture unpinned	fail	1 — UNPINNED on the .yaml file
empty workflow dir	fail	1 — empty-scan message

The .yaml case is asserted as counted (3 → 4 steps, 15 → 16 workflows), not merely as a run that happened to pass; 5b and 5c confirm it is actually parsed, not just globbed.

bin/ci green (exit 0).

---

Summary by cubic

Updates the golangci-lint lockstep check to catch stale pins and include .yaml workflows, preventing invisible drift and release breakage. It now scans both .yml and .yaml files and enforces a version floor.

• Bug Fixes
  • Scan *.yml and *.yaml; fail on an empty workflow scan.
  • Enforce a MIN_VERSION floor for the pinned golangci-lint; fail if below.
  • Compare versions with sort -V to avoid incorrect lexical ordering.
  • Preserve disagreement and UNPINNED checks; output now includes step and workflow counts.

^{Written for commit 6dc9163. Summary will update on new commits.}

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.