Enforce workflow best practices for internal action usage and checkout

[garrytrinder]

Issue #32 was previously raised and fixed. To prevent regressions, we should add automated checks (e.g., in a PR-created workflow) to ensure that:

• Only workflows located in the @dev-proxy-tools/actions/files/.github folder use ./<action-name> to invoke actions stored in this repository.
• Only these workflows use the actions/checkout action.

This will help enforce best practices and avoid similar issues in the future.