ci: pin actionlint and markdownlint-cli2 versions in Taskfiles

[Brian Gordon Davis (bgdnext64)]

Pins the remaining latest tool versions in the Taskfiles to specific releases, addressing the supply-chain and reproducibility concerns in the issue. The GO_VERSION map in golang.Taskfile.yml was already fully pinned; this change covers the other unpinned entries found during the audit.

Changes:

• github.Taskfile.yml: actionlint pinned to 1.7.12 (current latest).
• markdown.Taskfile.yml: markdownlintCli2 pinned to 0.23.0 (current latest).

Pinning surfaced two latent bugs in the install/verify tooling that only manifested once a specific version was actually requested (previously masked by latest). Both are fixed here:

• install_actionlint.sh prepended a v to numeric versions and passed v1.7.12 to the pinned download-actionlint.bash, which only accepts a bare 1.7.12 or latest and rejected it. The installer now strips any leading v instead of adding one.
• The shared command:version check ran <tool> --help | grep ... under bash -o pipefail. markdownlint-cli2 --help exits non-zero, so the pipeline failed even when the version matched. The check now neutralizes the wrapped command's exit code (and also inspects stderr) while still requiring the version string to be present.

Intentionally left unpinned:

• runtime.Taskfile.yml: pwsh stays latest. Its installers use the Microsoft package repository (Linux) and Homebrew (macOS), which only provide the latest release; setup_pwsh.sh explicitly errors out for any non-latest value. A comment now documents this so the entry isn't mistaken for an oversight.

The latest occurrences remaining in _internal.Taskfile.yml are template conditionals (comparisons against the string "latest"), not version pins. The installer scripts under .taskfiles/scripts/ default to latest only when no version is passed — the Taskfiles always pass an explicit pinned version.

Fixes #277

[Copilot]

Pull request overview

Pins remaining latest tool versions in Taskfiles to specific releases to improve supply-chain security and reproducibility, and fixes two installer/version-check edge cases that were previously masked by using latest.

Changes:

• Pin actionlint to 1.7.12 and markdownlint-cli2 to 0.23.0 in their respective Taskfiles.
• Fix .taskfiles/scripts/install_actionlint.sh to strip a leading v from explicit versions (to match download-actionlint.bash expectations).
• Make internal:command:version resilient to tools whose --help exits non-zero, while still requiring the pinned version string to be present (and including stderr in the check).

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
.taskfiles/scripts/install_actionlint.sh	Normalizes version input by stripping leading v so pinned installs work with the upstream download script.
.taskfiles/runtime.Taskfile.yml	Documents why pwsh remains intentionally unpinned (latest).
.taskfiles/markdown.Taskfile.yml	Pins markdownlint-cli2 to 0.23.0.
.taskfiles/github.Taskfile.yml	Pins actionlint to 1.7.12.
.taskfiles/_internal.Taskfile.yml	Updates version-check helper to tolerate non-zero --help and to search combined stdout/stderr.