ci: add autofix.ci (#5)

## What this does

Adds an `autofix.ci` workflow that runs the repo's checker in fix mode
on every push to `main` and on pull requests, then uses the
[autofix.ci](https://autofix.ci) app to push any resulting fixes back
onto the PR branch.

- Workflow `name` is exactly `autofix.ci` — the service identifies the
workflow by name for security.
- Fixer command: `vp check --fix` (the marimohub-style Vite+ fixer).
Wrapped in `|| true` so unfixable lint findings never block uploading
the fixes that did apply.
- Setup + install steps mirror this repo's own `ci.yml`:
`voidzero-dev/setup-vp` v0.2.4, Node version read from `.node-version`,
`sfw: true`, `cache: true`, frozen-lockfile install. Everything is
SHA-pinned with matching `# vX` comments.
- `autofix-ci/action` runs last.

The **autofix.ci GitHub App is installed org-wide** for marimo-team
(confirmed by an org admin), so no per-repo app configuration is needed.

## Verification

Cloned, `vp install --frozen-lockfile`, ran `vp check --fix`: formatting
completed and no warnings/lint errors across 77 files — the tree is
already clean, no diff. Workflow validated with `actionlint` (clean). No
code changes in this PR — workflow only.

Part of the marimo-team engineering-excellence initiative to standardize
autofix across repos.

Do not auto-merge.

Author: mscolnick

.github/workflows/autofix.yml

@@ -0,0 +1,42 @@
+name: autofix.ci # needed to securely identify the workflow
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  autofix:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+
+      - name: Read Node.js version
+        id: node-version
+        run: echo "version=$(cat .node-version)" >> "$GITHUB_OUTPUT"
+
+      - name: Set up Vite+
+        uses: voidzero-dev/setup-vp@2dec1e33f4ab2c6d5bce1b0c4607961bb1a3f7a1 # v1
+        with:
+          version: 0.2.4
+          node-version: ${{ steps.node-version.outputs.version }}
+          sfw: true
+          cache: true
+          run-install: |
+            - args: ['--frozen-lockfile']
+
+      # `vp check --fix` applies formatting/lint fixes. Unfixable lint errors
+      # are CI's job to report; don't let them block uploading the fixes that
+      # did apply.
+      - run: vp check --fix || true
+
+      - uses: autofix-ci/action@c5b2d67aa2274e7b5a18224e8171550871fc7e4a # v1.3.4