ci: add lint-cloudlinux GitHub Action

The cloudlinux fork uses the cloudlinux branch as trunk; the inherited
upstream workflows (unit-tests.yml, codespell.yml, etc.) only fire on
master so they never run for PRs into this fork. Add a narrow workflow
that runs on every push and PR targeting cloudlinux and invokes
`make lint-non-ascii` to gate against stray non-ASCII bytes in Python
source.

Calling the make target keeps a single source of truth: local
`make lint` runs the same check via the same script, so what passes
locally is exactly what passes in CI.

Resurrecting the full upstream test+lint matrix on this fork is a
separate, larger task.

Author: prilr

.github/workflows/lint-cloudlinux.yml

@@ -0,0 +1,36 @@
+name: Lint (cloudlinux)
+
+# CloudLinux fork uses the `cloudlinux` branch as trunk; the inherited
+# upstream workflows (unit-tests.yml, codespell.yml, etc.) only fire on
+# `master` and so do not run on this fork. This narrow workflow guards
+# the cloudlinux branch against the most common regression we have hit:
+# stray non-ASCII bytes in Python source (em-dashes, smart quotes,
+# ellipsis from copy/paste, leftover BOMs).
+#
+# The check is just `make lint-non-ascii`, which delegates to
+# utils/check-non-ascii.py. That same target is also invoked as a
+# prerequisite of `make lint`, so local developers get the identical
+# rule when they run the full lint locally.
+#
+# Broader fixes (running the full upstream test+lint matrix on cloudlinux
+# PRs) are tracked separately.
+
+on:
+  pull_request:
+    branches: [cloudlinux]
+  push:
+    branches: [cloudlinux]
+
+permissions:
+  contents: read
+
+jobs:
+  lint-non-ascii:
+    name: Reject undeclared non-ASCII in Python source
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: make lint-non-ascii
+        run: make lint-non-ascii