feat: add fast stale-lock-file CI gate for workflow markdown edits

[Copilot]

Stale .lock.yml files after editing .github/workflows/*.md are the highest-confidence recurring CI failure. The existing check-workflow-drift job catches this but only after building the binary (~10 min). This adds a binary-free fast gate that fails in ~30 seconds.

Changes

ci.yml — new check-stale-lock-files job

• Runs standalone with no binary dependency (pure git + shell)
• Uses fetch-depth: 0 and passes github.event.before as GITHUB_BEFORE_SHA to diff exactly what changed in the push
• Falls back gracefully (exit 0) on schedule/dispatch runs with no push base

Makefile — extend check-stale-lock-files target

• Adds a third env-var probe: GITHUB_BEFORE_SHA (checked after CHECK_STALE_LOCK_BASE_REF and GITHUB_BASE_REF), enabling the Makefile target to resolve the correct base ref for push events where GITHUB_BASE_REF is unset
• Documents all three supported env vars in the comment

# New CI job — no binary needed, runs immediately
check-stale-lock-files:
  runs-on: ubuntu-latest
  steps:
    - uses: actions/checkout@...
      with: { fetch-depth: 0 }
    - env: { GITHUB_BEFORE_SHA: "${{ github.event.before }}" }
      run: make check-stale-lock-files

• Fixes [hippo] [Code Quality] Enforce make recompile after workflow markdown edits #48154