feat: extend actionlint with optional shellcheck support

[rldyourmnd]

Summary

Extends actionlint.yml with three new optional inputs that add an opt-in
shellcheck pass after actionlint. All default to the prior behaviour (shellcheck
off), so existing callers are unaffected.

• enable_shellcheck (boolean, default false) — when true, downloads and runs
  shellcheck on shell scripts after actionlint.
• shellcheck_version (string, default 0.11.0) — shellcheck release version
  (no leading v).
• shellcheck_sha256 (string, default '') — SHA256 of
  shellcheck-v<version>.linux.x86_64.tar.xz. Required when enable_shellcheck
  is true (the download step fails closed if empty).

When enabled, two new guarded steps (if: ${{ inputs.enable_shellcheck }})
run after Run actionlint:

1. Download shellcheck (pinned + checksum-verified) — downloads the
   linux.x86_64.tar.xz tarball, verifies it with sha256sum -c -, and
   installs into \$RUNNER_TEMP/bin (same runner-writable pattern as the
   actionlint binary). All values pass through env: (no ${{ inputs }} in
   run:).
2. Run shellcheck — runs on tracked *.sh files (via git grep -Il,
   scoped to the checkout) with --check-sourced --external-sources.

Type of change

• Extension to an existing workflow

Threat-model note

No new third-party action; the only new network fetch is the checksum-verified
shellcheck binary from the official koalaman/shellcheck GitHub releases, verified
with sha256sum -c - before extraction (same discipline as the actionlint
binary). No permission scope changes. Caller-supplied strings flow through
env: only, never interpolated into run:. The download step fails closed when
shellcheck_sha256 is empty.

Permissions diff

No change. actionlint job keeps contents: read only.

Runtime-coverage note

actionlint.yml was runtime-proven at a proven_digest; editing the file
breaks the digest gate (AGENTS.md). Without a fresh observed workflow_call run
available, this PR downgrades the entry to static-only (validator
scripts/check_actionlint_contract.py, which still enforces the first-step
Linux X64 runner guard) until a live run re-proves it. This is the documented
honest downgrade path.

Checklist

• Third-party actions pinned to full 40-char SHA + # vX.Y.Z comment (none added).
• Least-privilege permissions (unchanged).
• timeout-minutes present (unchanged).
• persist-credentials: false on read-only checkout (unchanged).
• No ${{ inputs.* }} inside run: — values pass through env:.
• catalog/capabilities.yml updated (risk note + last_verified).
• catalog/runtime-coverage.yml updated (honest downgrade to static-only).
• docs/generated/* regenerated (no matrix drift).
• CHANGELOG.md updated under [Unreleased] -> ### Added.
• Commits signed (-S) and signed off (-s).

Validation note

python3 scripts/validate_all.py reports only the two pre-existing failures on
main (pinned-actions and catalog, both from clusterfuzzlite/rust-supply-chain
PRs #68/#69 and unrelated to this change). The runtime-coverage digest
mismatch introduced by editing actionlint is resolved by the downgrade above.
This PR adds no new failures.