Clarify workflow YAML review tooling

[mfoltz]

Motivation

• Make reviewer-facing workflow-review guidance explicit about using the repo-managed environment before running local YAML parsing checks.
• Avoid false-positive workflow syntax defect reports when a local YAML parser dependency is missing.
• Provide a simple guarded example for running Python-based YAML validation that separates dependency availability from YAML content validation.

Description

• Updated .github/CONTRIBUTING.md to instruct contributors to run bash .codex/install.sh in the repo-managed environment before performing YAML parsing checks and to note that the inline import yaml example depends on PyYAML.
• Added a guarded Python example that first checks python3 -c 'import yaml' and either warns about the missing PyYAML dependency or runs a yaml.safe_load parse of .github/workflows/release.yml.
• Updated .github/instructions/workflows.instructions.md with the same guidance for reviewers and an explicit statement that a missing YAML parser dependency is a local tooling issue, not a GitHub Actions workflow syntax defect.

Testing

• Ran bash .codex/install.sh, which provisioned the .NET SDK, installed PyYAML and shellcheck, and built the project successfully.
• Ran bash .codex/shellcheck.sh to lint shell scripts and it completed without errors.
• Ran the guarded Python YAML parse (python3 -c 'import yaml' guard + yaml.safe_load on .github/workflows/release.yml) and the workflow file parsed successfully.

---

Codex Task

[Copilot]

Pull request overview

This PR clarifies reviewer/contributor guidance for locally validating GitHub Actions workflow YAML by emphasizing use of the repo-managed environment/tooling and by providing a guarded Python YAML-parse example that distinguishes missing dependencies from actual YAML/workflow defects.

Changes:

• Updates workflow review instructions to recommend running bash .codex/install.sh before local YAML parsing checks and to explicitly note the PyYAML dependency.
• Updates contributing guidance with the same dependency caveat and adds a guarded import yaml check before attempting yaml.safe_load.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
.github/instructions/workflows.instructions.md	Adds reviewer guidance about running repo tooling first and treating missing YAML parser deps as a local issue.
.github/CONTRIBUTING.md	Adds contributor-facing guidance plus a guarded Python YAML-parse example for .github/workflows/release.yml.