GitHub Actions workflows often accumulate configuration smells that developers hesitate to fix for fear of breaking CI/CD pipelines. Analyzing 13,380 workflow evolution traces, we observe smell masking, where syntax errors hide underlying smells, and smell persistence, where smells remain after workflows become functional. While Large Language Models (LLMs) can propose repairs, even GPT-5.2 frequently rewrites workflow structure or changes triggers and conditions, undermining trust. We propose GHA-Repair, a verification-oriented framework that uses a staged generation process (syntax repair → smell repair) and applies rule-based constraints. Candidates are evaluated by a hybrid verifier that checks structural preservation and Satisfiability Modulo Theories (SMT)-based control-flow equivalence (on, if, concurrency) within a defined scope. On a newly curated dataset of 6,998 workflow evolution pairs (GHA-Evo-7K), GHA-Repair improves repair reliability across multiple LLMs. In our evaluation, GHA-Repair with Qwen2.5-Coder-14B achieves 80.7% smell-removal recall and a 41.3% scope-verified patch rate. Our findings suggest that verification-backed guardrails are key to reliable CI/CD maintenance in practice. We also characterize the primary sources of verification failures.