perf(pr-lint): unconditional full-history checkout in change-log-entry-is-in-unreleased runs even when every following step is skipped

[credfeto]

Found during AI review of all workflows/actions.

Problem

.github/workflows/pr-lint.yml:112-116 — the change-log-entry-is-in-unreleased job checks out with fetch-depth: 0 unconditionally, but every subsequent step is gated on github.actor != 'dependabot[bot]' && !endsWith(github.repository, '-template'). On dependabot PRs and in template repos the job does a full-history clone and then does nothing.

Plan

• Add the same condition to the checkout step, or lift it to job level (if: on the job) so the runner is not allocated at all — job-level is cleaner since all steps share the condition.
• Check the sibling jobs for the same pattern while there.

[dnyw4l3n13]

Implementation Plan

Files to change

• .github/workflows/pr-lint.yml: lift the github.actor != 'dependabot[bot]' && !endsWith(github.repository, '-template') condition from the individual steps of the change-log-entry-is-in-unreleased job (currently only on the "Check Required Secrets", "Install dotnet", "Install Changelog tool" and "Check Changelog" steps) up to the job level, combined with the job's existing github.event.pull_request.draft == false condition. The "Checkout Source" step (fetch-depth: 0) has no if today, so it always runs a full-history clone even when every step after it is skipped on dependabot PRs or in template repos; making it inherit the job-level condition removes that wasted work.
• CHANGELOG.md: placeholder entry, added as the branch's first commit per the standard workflow (Orchestrator step 7).

Approach

Change the job's if: from github.event.pull_request.draft == false to a multi-line condition ANDing in the dependabot/template check, and delete the now-redundant per-step if: conditions on "Check Required Secrets", "Install dotnet", "Install Changelog tool" and "Check Changelog" (the "Checkout Source" step gets no if added to it individually - it inherits the job-level gate like every other step in the job). Verified via .github/actions/branch-protection-sync/action.yml that only jobs with a # @@required: <scope> marker comment immediately above the job key become required status checks; change-log-entry-is-in-unreleased has no such marker, so converting the job's outcome from "ran, steps skipped" to "skipped entirely" on dependabot/template runs cannot break branch protection. Swept the rest of .github/workflows/*.yml and .github/actions/*/action.yml for the same dependabot[bot] / -template pattern (no .yaml-extension workflow files exist in this repo): the sibling job include-changelog-entry in the same file already gates its own "Checkout Source" step with this exact condition (line 82), so it does not have this bug. The other matches are either job-level conditions already covering their whole job (pr-update.yml), or per-step conditions inside composite actions that are not checkout/clone related (build/action.yml, dotnet/action.yml). No other occurrences of the bug pattern were found.

Test strategy

No unit tests apply; this is workflow YAML. Verification is: (1) lint-code's actionlint pass (via super-linter, VALIDATE_GITHUB_ACTIONS: true) confirms the YAML/expression syntax is valid, and (2) observing the change-log-entry-is-in-unreleased job's own conclusion on this change's PR - since this repo is itself a -template repo, the fix takes effect immediately on its own PR, so the job should show as skipped rather than running a full clone that then no-ops.

Assumptions

• The Pre-Work Baseline Check (<hooks-path>/pre-commit --all-files) runs at the start of the implementation cycle, before branching, per the standard Orchestrator flow; it is not part of this plan-mode comment.
• No other workflow or action files beyond those swept above contain this pattern.

Open questions

None, ready to proceed pending approval

[dnyw4l3n13]

This item's agent container has failed 5 times in a row before Claude could even start (a pre-flight/infra failure, not a Claude-level one — e.g. a workspace-trust or environment check in entrypoint.sh). Blocking for a human to investigate the container/image rather than retrying forever.