…comment fix

Self-review LOW items applied:

1. Installer script ref `main` → `v1.7.12` — pinning the binary
   version arg alone left upstream free to rewrite the installer
   script itself. Both refs now pinned to the same release.

2. Explicit `permissions: { contents: read }` block. Inheriting from
   org default works today but the explicit block makes the
   read-only intent self-documenting in the workflow file.

3. Header comment "three reusable workflows" → "three + this
   actionlint.yml itself" since actionlint auto-discovers all
   .github/workflows/*.yml from the repo root and lints itself too.

No behavior change beyond the supply-chain tightening.

CI ran the workflow and actionlint exited 2 with a help dump because
`-color=never` is not a recognized flag. The actionlint CLI uses
boolean toggles: `-color` (force on) and `-no-color` (force off) —
no `=value` form.

Caught by the workflow itself on first PR run, exactly the kind of
issue this workflow exists to surface (though it caught its own
typo rather than other workflows', which is also fine).

actionlint's bundled shellcheck flags SC2016 ("Expressions don't
expand in single quotes") on the resolver step's `node -e '...'`
block. False positive — the `$` chars inside the single-quoted JS
body are regex anchors (`/(^|\/)\.env($|\.|\/)/` etc.) and
`process.env.X` accesses, not shell variable interpolation.

Adds inline `# shellcheck disable=SC2016` directive scoped to that
single run block. Comment explains the false-positive context so
future readers know why the rule is suppressed.