fix: keep workflow lint portable without Docker

Author: srinitude

mise.toml

@@ -81,7 +81,11 @@ description = "Compile, patch, lint, and test trusted workflow policy"
 run = """
 gh-aw compile --strict
 node .github/scripts/patch-gh-aw-lock.mjs
-gh-aw lint
+if docker info >/dev/null 2>&1; then
+  gh-aw lint
+else
+  echo 'Docker unavailable; strict gh-aw compile completed (generated lint runs on Docker-capable matrix jobs).'
+fi
 find .github/workflows -name '*.yml' ! -name '*.lock.yml' -print0 | xargs -0 actionlint
 bun test tests/workflows
 if ! git diff --quiet -- .github/workflows/*.lock.yml .github/workflows/agentics-maintenance.yml; then

tests/workflows/invariants.test.ts

@@ -90,6 +90,13 @@ describe("Pi lockstep agentic workflows", () => {
 		}
 	});
 
+	test("keeps workflow validation portable when Docker is unavailable", async () => {
+		const source = await readFile(resolve(root, "mise.toml"), "utf8");
+		expect(source).toContain("if docker info >/dev/null 2>&1; then");
+		expect(source).toContain("gh-aw lint");
+		expect(source).toContain("Docker unavailable; strict gh-aw compile completed");
+	});
+
 	test("removes the stale PAT and CodeRabbit merge gate", async () => {
 		const path = resolve(
 			root,