[Feature]: test suite for workflows and actions (after v4) #60

Summary

Add a real test suite for this repo's workflows and actions. Today everything is verified by hand through github-actions-testbed, which proves the happy path but doesn't cover failure paths or catch regressions as things change.

Out of scope for the v4 stack; to be picked up right after v4 is released (v4 unblocks the distributor).

Plan

• Move workflow logic out of inline run: blocks into bash scripts.
• Test those scripts with bats-core.
• Run the tests in CI. Possibly a separate test repo that triggers on new commits here, so this repo stays free of test scaffolding; the testbed stays the usage example.
• Cover every workflow and action consistently, not one-off fixtures.

Known cases to cover

• govulncheck: malformed SARIF (missing runs, results, or rules) fails the structure check (feat(workflows)!: step 11, upload govulncheck findings as SARIF #53).
• gpg-verify-trust-chain: expired and revoked certifications fail verification (refactor(actions): step 12, move gpg-verify-trust-chain checks into a script #58).
• lint-codegen-fabrica: generated-code drift fails the check (verified once by hand on feat!: testing for actions PR 51 github-actions-testbed#14).

Context

Raised in #53 (comment).