fix(ci): exclude *.lock.yml from actionlint

[don-petry]

Problem

After fixing yamllint to exclude *.lock.yml (PR #321), actionlint still runs on lock files via .github/workflows/*.yml glob. The ci-failure-analyst.lock.yml uses ubuntu-slim runner label which actionlint rejects.

Fix

In .github/workflows/ci.yml, change the actionlint invocation from:

          ./actionlint -ignore 'SC2129' .github/workflows/*.yml

to:

          shopt -s extglob
          ./actionlint -ignore 'SC2129' .github/workflows/!(*.lock).yml

The extglob pattern !(*.lock).yml excludes .lock.yml files without introducing word-splitting issues (SC2046).