ci(arvindrk-extract-design-system): add HOL ai-plugin-scanner workflow

[internet-dot]

I opened this to add a scanner-only check for the Codex plugin surface in the repo.

A couple of repo-specific details I checked first:

• This repository is skills-first. It publishes an installable extract-design-system skill, and the bundled CLI is the executable workflow the agent runs under the hood
• You want a repeatable workflow instead of ad hoc prompting
• Once installed, the skill is available to supported coding agents. The agent should use it when a request matches the extraction workflow

The current local scan came back 85/100 (grade B).

This PR only adds the scanner workflow. It does not touch runtime code or release behavior.
If you would rather wire it in a different workflow file, I can adjust the branch.