chore: lint the codebase

[DevSecNinja]

Description

Changes

Checklist

• Linting passes locally (mise exec -- lefthook run pre-commit)
• Commit messages follow Conventional Commits
• Documentation updated (if applicable)

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[DevSecNinja]

@copilot Can you fix the pipelines and any open linter findings? End goal: pipeline must pass with linted files.

[Copilot]

@copilot Can you fix the pipelines and any open linter findings? End goal: pipeline must pass with linted files.

Done in f495307. I reproduced each linter locally and fixed all findings:

• dprint – formatted all Markdown under .apm/, plus README.md, INDEX.md, docs/, and templates.
• shfmt / shellcheck – reformatted shell scripts to 4-space indent and resolved SC2129/SC2248/SC2250/SC2310/SC2312 in generate-index.sh, validate-prompts.sh, guard-tool.sh, and post-create.sh (output verified byte-identical where behavior matters).
• yamlfmt / yamllint – formatted the workflow YAML (document start, block arrays, trailing whitespace).
• actionlint – quoted $GITHUB_OUTPUT (SC2086) and moved github.head_ref/github.event_name into env: to avoid script injection in generate-index.yml.
• Made scripts/generate-index.sh emit dprint-canonical output so the auto-generated index never re-triggers a dprint failure.
• Added yamlfmt to .mise.toml, which was the cause of the Auto-fix formatting job failure (mise ERROR "yamlfmt" couldn't exec process).

Note: the checkov and trivy sub-jobs fail because their SARIF outputs aren't produced in the reusable workflow (DevSecNinja/.github) — that's outside this repo and those jobs are continue-on-error. All other linters are clean locally. The new workflow runs are currently action_required (awaiting your approval to run).