ci: fix workflow-linter YAML parse error + self-flag bug

Sync canonical fixed version from gitbot-fleet. Combined fix:
  1. The 'Add permissions...' multi-line echo had a YAML literal-block
     indentation bug that crashed the workflow file parser.
  2. The action-pinning grep matched its own source line.
Anchored to '^[[:space:]]+uses:' so only real workflow steps match.

Author: hyperpolymath

.github/workflows/workflow-linter.yml

@@ -54,8 +54,7 @@ jobs:
             fi
           done
           if [ $failed -eq 1 ]; then
-            echo "Add 'permissions:
-  contents: read' at workflow level"
+            echo "Add a top-level 'permissions:' block (e.g. {contents: read})"
             exit 1
           fi
           echo "All workflows have permissions declared"
@@ -65,7 +64,7 @@ jobs:
           echo "=== Checking Action Pinning ==="
           # Find any uses: lines that don't have @SHA format
           # Pattern: uses: owner/repo@<40-char-hex>
-          unpinned=$(grep -rn "uses:" .github/workflows/ | \
+          unpinned=$(grep -rnE "^[[:space:]]+uses:" .github/workflows/ | \
             grep -v "@[a-f0-9]\{40\}" | \
             grep -v "uses: \./\|uses: docker://\|uses: actions/github-script" || true)