ci: tune rails actionlint

[haasonsaas]

Summary

• keep the reusable Codex Rails workflow focused on GitHub Actions workflow semantics
• disable actionlint ShellCheck and Pyflakes integrations in the reusable workflow, matching repos that run those checks separately
• avoid turning org rails adoption into a broad shell lint migration

Test plan

• ruby YAML parse for .github/workflows/codex-rails-check.yml
• actionlint .github/workflows/codex-rails-check.yml
• ruby -Itest test/audit_engineering_practices_test.rb
• ruby -Itest test/verify_org_control_plane_contract_test.rb
• ruby -Itest -e 'ARGV.each { |path| require ./#{path} }' test/*_test.rb
• git -c core.fsmonitor=false diff --check