feat: add fast stale-lock-file CI gate for workflow markdown edits

.github/workflows/ci.yml

@@ -134,6 +134,23 @@ jobs:
         fi
 
         echo "validated $checked_images container pins across $checked_files workflow lock files"
+  check-stale-lock-files:
+    name: Check for stale workflow lock files
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd   # v6.0.2
+      with:
+        fetch-depth: 0
+
+    - name: Check for stale lock files
+      env:
+        GITHUB_BEFORE_SHA: ${{ github.event.before }}
+      run: make check-stale-lock-files
+
   integration:
     name: "Integration: ${{ matrix.test-group.name }}"
     if: ${{ needs.changes.outputs.has_changes == 'true' }}

Makefile

@@ -822,6 +822,11 @@ lint-lock: build
 # without their .lock.yml being regenerated.  Uses git to identify modified files
 # and does not require the gh-aw binary.  Complements check-workflow-drift (which
 # does a full recompile) by catching the obvious staleness case early.
+#
+# Supported env vars (checked in order):
+#   CHECK_STALE_LOCK_BASE_REF - explicit base ref override (any git ref)
+#   GITHUB_BASE_REF           - PR base branch name (set by GitHub Actions on pull_request events)
+#   GITHUB_BEFORE_SHA         - pre-push commit SHA (set in CI for push events via github.event.before)
 .PHONY: check-stale-lock-files
 check-stale-lock-files:
 	@base_ref="$${CHECK_STALE_LOCK_BASE_REF:-}"; \
@@ -832,6 +837,11 @@ check-stale-lock-files:
 			base_ref="$${GITHUB_BASE_REF}"; \
 		fi; \
 	fi; \
+	if [ -z "$$base_ref" ] && [ -n "$${GITHUB_BEFORE_SHA:-}" ]; then \
+		if git rev-parse --verify "$${GITHUB_BEFORE_SHA}^{commit}" >/dev/null 2>&1; then \
+			base_ref="$${GITHUB_BEFORE_SHA}"; \
+		fi; \
+	fi; \
 	if [ -n "$$base_ref" ]; then \
 		bash scripts/check-stale-lock-files.sh --base-ref "$$base_ref"; \
 	else \