ci: add a lint workflow with a check job

[goastler]

Adds .github/workflows/lint.yml with a single job named check:

• actionlint over workflow files (it also shellchecks the run: blocks inside them)
• yamllint over every yaml in the repo, with a deliberately loose config -- the aim is catching duplicate keys and unparseable files, not enforcing a style on files that already work
• shellcheck over the run: blocks inside composite action.yml files, via .github/scripts/lint_composite_shell.py. actionlint ignores action.yml entirely, and composite actions are what this repo is made of, so without this their shell was never linted at all. The extractor rewrites \${{ ... }} to a placeholder first, since those expressions are not shell syntax and otherwise produce a parse error in every file.

The job name is not incidental: the main ruleset requires a status context called check, but the repo published no checks at all, so that context could never be reported and every PR was permanently unmergeable ("the base branch policy prohibits the merge"). This is what makes #2 mergeable.

Linters run even where there is currently nothing of that kind to lint -- that is the point; it stops such code arriving unlinted later.

Two pre-existing findings surfaced and are fixed in the same commit, so the linter lands blocking and green:

• rust-toolchain: three individual >> \$GITHUB_OUTPUT redirects grouped and quoted (SC2129/SC2086)
• npm: npm ci \${{ inputs.npm_ci_args }} given an explicit shellcheck disable=SC2086 -- it must word split, so quoting it would be a behaviour change