ci: add calens validation job to CI workflow

[DeepDiver1975]

Summary

Add a Changelog lint CI job that runs calens on every PR and master push. This catches malformed changelog entries in changelog/unreleased/ before they can block the auto-changelog generation workflow on master (as happened in https://github.com/owncloud/core/actions/runs/27135471818).

Changes

• New calens job in .github/workflows/ci.yml
• Uses actionhippie/calens@0b8ceba55a72f5ef8b7d910698fcd28be8bb8c19 (v1.13.4) — SHA-pinned to match the pin already used in the reusable calens.yml workflow
• Runs on both PRs and master pushes via the existing on: trigger block

Test plan

• The "Changelog lint" check appears and passes on this PR

🤖 Generated with Claude Code

[DeepDiver1975]

Code Review — ci: add calens validation job to CI workflow

Overview: Adds a Changelog lint CI job using calens to validate changelog/unreleased/ entries on every PR and master push. Also fixes a malformed changelog entry in changelog/unreleased/41597 (Fix: → Bugfix:).

CI job

calens:
  name: Changelog lint
  runs-on: ubuntu-latest
  steps:
    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
    - uses: actionhippie/calens@0b8ceba55a72f5ef8b7d910698fcd28be8bb8c19 # v1.13.4

Both actions are SHA-pinned ✅ — consistent with the existing calens.yml reusable workflow policy. The job runs under the existing on: triggers (PR + master push). ✅

OSPO Actions policy: The new agents.md file (added in #41567) states workflows may only use actions owned by owncloud, created by GitHub (actions/*), or verified in the GitHub Marketplace. actions/checkout is GitHub-owned ✅. actionhippie/calens — this is the same action already used in the repo's reusable calens.yml workflow, so it's an established pattern rather than a new third-party addition. ✅

Changelog fix

Fix: → Bugfix: in changelog/unreleased/41597 — this is exactly the kind of malformed entry the new job catches. Having it fixed in this same PR demonstrates the value of the linter. ✅

Summary

Aspect	Assessment
SHA-pinned actions	✅ Both pinned
Consistent with existing calens usage	✅ Same action/SHA as reusable workflow
Changelog fix bundled	✅ Demonstrates the linter's value

Verdict: Ready to merge.