fix(markdown-lint): run markdownlint standalone / avoid EBADENGINE error (#110)

Avoids causing failing PR checks in workflow-reusing repositories,
such as `advanced-security/codeql-development-mcp-server` repo.

Fixes the cause of the EBADENGINE error for cases where:

- `npm ci` ran on the runner's default Node against the *calling* repo;
- the following settings are configured in files in *calling* repo root:
  - `engine-strict=true` in `.npmrc`, AND
  - `engines` range in `package.json` above the runner's default Node version.

Summary of changes in this commit:

- Drop the `npm ci` step; fetch a pinned `markdownlint-cli@0.49.1` via `npx`
- Add `actions/setup-node` on Node 24 with `package-manager-cache: false`
- Pass `--ignore-scripts` so no lifecycle script runs while fetching the linter
- Set `persist-credentials: false` on checkout
- Pin `actions/checkout` to a commit SHA and annotate the `paths-filter` pin

Author: data-douser

.github/workflows/markdown-lint.yml

@@ -1,4 +1,4 @@
-name: 'Markdown Lint'
+name: Markdown Lint
 
 on:
   pull_request:
@@ -12,22 +12,36 @@ jobs:
   markdown-lint:
     runs-on: ubuntu-latest
     steps:
-      - name: 'Checkout Repository'
-        uses: actions/checkout@v7
+      - name: Checkout Repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
-      - name: "Filter Changes"
-        uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706
+      - name: Filter Changes
+        uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
         id: changes
         with:
           filters: |
             src:
               - '**/*.md'
 
-      - name: "Install Dependencies"
+      - name: Setup Node.js
         if: steps.changes.outputs.src == 'true'
-        run: npm ci
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          # pinned major: a required check should not follow LTS rollovers
+          node-version: '24'
+          # nothing below runs `npm ci`, so the caller's npm cache is dead weight
+          package-manager-cache: false
 
-      # lint markdown
-      - name: "Lint Markdown"
+      # markdownlint-cli is run standalone so this reusable workflow never installs the
+      # caller's dependencies, whose `engines`, lockfile, or `.npmrc` (e.g.
+      # `engine-strict=true`) can fail `npm ci` here. The registry is left to the
+      # caller's `.npmrc`, but `--ignore-scripts` outranks it and cannot be re-enabled.
+      - name: Lint Markdown
         if: steps.changes.outputs.src == 'true'
-        run: npx markdownlint-cli '**/*.md' --ignore node_modules --disable MD013
+        run: |-
+          npx --yes --ignore-scripts markdownlint-cli@0.49.1 \
+            '**/*.md' \
+            --ignore node_modules \
+            --disable MD013