[CI] Add lint workflow running pre-commit (#16275)

It adds a new _Lint_  workflow which runs `pre-commit` in CI. It only tests files that have changes compared to the base ref of a PR, or `master`.
Workflow dispatch allows running `pre-commit` against all files in the repo.

We already have a couple of individual CI jobs that run some of these linter: `lint-actionlint`, `lint-shellcheck`, `lint_spellcheck`. The new setup replaces them. But I'm keeping them around for a while to ensure the new workflow functions properly.

Author: straight-shoota

.github/workflows/lint.yml

@@ -0,0 +1,32 @@
+name: Lint
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  pre-commit:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download source
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+      - uses: cachix/install-nix-action@fd24c48048070c1be9acd18c9d369a83f0fe94d7 # v31
+      - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
+        with:
+          name: devenv
+      - name: Install devenv.sh
+        run: nix profile install nixpkgs#devenv
+      - name: "Download target branch: ${{ github.base_ref || 'master' }}"
+        run: git fetch origin "${TARGET_BRANCH}"
+      - name: Run pre-commit hooks for changes against target branch (${{ github.base_ref || 'master' }})
+        run: pre-commit run --from-ref "origin/${TARGET_BRANCH}" --to-ref HEAD
+        shell: devenv shell bash -- -e {0}
+        if: "${{ github.event_name != 'workflow_dispatch' }}"
+      - name: Run pre-commit on all files
+        run: pre-commit run --all-files
+        shell: devenv shell bash -- -e {0}
+        if: "${{ github.event_name == 'workflow_dispatch' }}"
+    env:
+      TARGET_BRANCH: "${{ github.base_ref || 'master' }}"