ci: fix workflow-linter YAML parse error + self-flag bug

Sync canonical fixed version from gitbot-fleet. Combined fix:
  1. The 'Add permissions...' multi-line echo had a YAML literal-block
     indentation bug that crashed the workflow file parser.
  2. The action-pinning grep matched its own source line.
Anchored to '^[[:space:]]+uses:' so only real workflow steps match.

Author: hyperpolymath

.github/workflows/workflow-linter.yml

@@ -12,7 +12,8 @@ on:
       - '.github/workflows/**'
   workflow_dispatch:
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   lint-workflows:
@@ -22,7 +23,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Check SPDX Headers
         run: |
@@ -53,7 +54,7 @@ jobs:
             fi
           done
           if [ $failed -eq 1 ]; then
-            echo "Add 'permissions: read-all' at workflow level"
+            echo "Add a top-level 'permissions:' block (e.g. {contents: read})"
             exit 1
           fi
           echo "All workflows have permissions declared"
@@ -63,7 +64,7 @@ jobs:
           echo "=== Checking Action Pinning ==="
           # Find any uses: lines that don't have @SHA format
           # Pattern: uses: owner/repo@<40-char-hex>
-          unpinned=$(grep -rn "uses:" .github/workflows/ | \
+          unpinned=$(grep -rnE "^[[:space:]]+uses:" .github/workflows/ | \
             grep -v "@[a-f0-9]\{40\}" | \
             grep -v "uses: \./\|uses: docker://\|uses: actions/github-script" || true)
 
@@ -72,7 +73,7 @@ jobs:
             echo "$unpinned"
             echo ""
             echo "Replace version tags with SHA pins, e.g.:"
-            echo "  uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4.1.1"
+            echo "  uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.1"
             exit 1
           fi
           echo "All actions are SHA-pinned"