ci: bump fleet-lint to v1.3.1 (#12)

Moves the fleet-lint pin from kleinbem/actions v1.3.0 to v1.3.1
(kleinbem/actions#14): markdownlint only takes real config files as repo
config, ruff runs isolated with a fixed rule set, gitleaks scans
merge-commit resolutions, and the composite-action shellcheck follows
each step's shell.

Tested: ran v1.3.1 locally against this repo's current main, and every
check passed. It passed on all 29 repos.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

<!-- coderabbit-ai-generated:v1 -->

## Summary by CodeRabbit

* **Chores**
* Updated the versions used by automated checks. No changes to the
end-user experience.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: kleinbem

.github/workflows/fleet-lint.yaml

@@ -17,5 +17,5 @@ jobs:
         with:
           fetch-depth: 0 # gitleaks scans every commit of the PR
           persist-credentials: false
-      - uses: kleinbem/actions/nix-setup@fac6dda312df4b995db2fff7e8552945104b050c # v1.3.0
-      - uses: kleinbem/actions/lint@fac6dda312df4b995db2fff7e8552945104b050c # v1.3.0
+      - uses: kleinbem/actions/nix-setup@f716d62182471a9e862ae0bd61d34201e6cea971 # v1.3.1
+      - uses: kleinbem/actions/lint@f716d62182471a9e862ae0bd61d34201e6cea971 # v1.3.1