[KOliver94]

Every workflow in the studio's repositories now follows one written convention, docs/workflows.md, and a reusable workflow enforces it.

• .github/workflows/shared-checks.yml (called from each repository's checks.yml):
  • Workflows runs actionlint, zizmor (with every action required to be pinned by commit SHA) and scripts/check-workflows.mjs over the repository's workflows and composite actions.
  • Dependencies reviews new and changed dependencies for known vulnerabilities and for licences outside the allow-list, in repositories that set dependency-review: true.
• The checks run from the composite action .github/actions/workflow-checks, which the shared workflow reaches through the $/ self-repository syntax, so tools, configuration and workflow always come from the same commit. actionlint and zizmor run from digest-pinned container images that Renovate keeps current.
• scripts/check-workflows.mjs covers the parts of the convention no other tool checks: key order, permissions, concurrency, bash as the shell, job names and timeouts, step layout, if conditions, expressions inside run, spacing and quoting. It is dependency-free and tested with node:test.
• This repository runs the checks on itself through a local reference, so a pull request here tests the version it changes. test.yml follows the convention.