cicd-fy

This workflow is intended to automate lint and formatting fixes and manage a corresponding PR. Its principal security concern is that it executes PR-controlled mise tasks while `GH_TOKEN` is available and checkout credentials persist; a malicious same-repository PR could potentially steal or misuse write-capable credentials. The fork guard only skips the later PR-synchronization step, not task execution, while fork tokens are normally read-only. No direct malware or external exfiltration destination is shown; severity is high for untrusted same-repository PRs unless their authors are trusted or execution is otherwise isolated.