ci: add autofix.ci

[mscolnick]

What this does

Adds an autofix.ci workflow that runs the repo's checker in fix mode on every push to main and on pull requests, then uses the autofix.ci app to push any resulting fixes back onto the PR branch.

• Workflow name is exactly autofix.ci — the service identifies the workflow by name for security.
• Fixer command: pnpm exec vp check --fix (the check script is vp check; --fix is its mutating variant). Wrapped in || true so unfixable lint findings (CI's job to report) never block uploading the formatting fixes that did apply.
• Setup + install steps mirror this repo's own CI (test.yml): checkout v7, pnpm/action-setup v6, setup-node 24, pnpm install --ignore-scripts --frozen-lockfile. Everything is SHA-pinned with matching # vX comments.
• autofix-ci/action runs last.

The autofix.ci GitHub App is installed org-wide for marimo-team (confirmed by an org admin), so no per-repo app configuration is needed.

Verification

Cloned, pnpm install --ignore-scripts --frozen-lockfile, ran pnpm exec vp check --fix: formatting completed with no diff (tree already formatted). It surfaced pre-existing lint findings (34 errors / 6 warnings, mostly no-redundant-type-constituents in tests) that oxlint cannot auto-fix — these are left for CI to report and are unaffected by this PR. Workflow validated with actionlint (clean). No code changes in this PR — workflow only.

Part of the marimo-team engineering-excellence initiative to standardize autofix across repos.

Do not auto-merge.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.