ci: verify the shellcheck download instead of trusting the transport

[Jaro-c]

Summary

The only two network downloads in this repository — the shellcheck tarball in shell-ci.yml and in workflow-lint.yml — fetched over HTTPS and extracted unchecked, and shell-ci.yml declined a checksum in a comment: "the tarball comes straight from koalaman/shellcheck's own GitHub release over HTTPS, so there is no separate checksum to embed."

Every other tool here arrives through a registry that verifies what it hands over (Go's sumdb, crates.io, PyPI). These two were the only places in a repository built on "the pin is the security boundary" that trusted the transport instead.

What this buys, stated honestly: koalaman publishes no checksum file and no signatures alongside the release — I checked the assets for v0.11.0 and there are seven tarballs and nothing else. So the hash pins the artifact I measured, not one upstream attests to. It detects a replaced or re-uploaded asset; it does not detect an upstream that was malicious from the start.

Changes

• The tarball lands in a file and is verified with sha256sum -c before extraction. curl | tar could never have verified anything — the bytes are extracted as they arrive.
• The hash is an input beside shellcheck-version, so the two travel together: a consumer bumping only the version fails the install rather than silently downloading something unverified.
• actionlint.yml gets the same install and passes the binary through -shellcheck. Its embedded pass was falling back to the runner image's floating shellcheck, which is exactly what workflow-lint installs a pinned one to avoid — this repository was linting itself to a weaker standard than the one it ships to consumers.
• .gitignore: Python bytecode, since running the docs generator leaves scripts/__pycache__ behind.

Test plan

• Ran the install script the way a runner does — a standalone bash script, not inside an && list. That distinction mattered: my first attempt wrapped it in &&, where errexit is ignored, and it wrongly showed a wrong hash passing.
  • correct hash: extracts, reports version: 0.11.0, exit 0
  • wrong hash: sha256sum: WARNING: 1 computed checksum did NOT match, exit 1, shellcheck-bin/ empty, nothing extracted
• actionlint 1.7.12 clean over the tree locally.
• Pages regenerated: the two new inputs are the only content change.

Note on the release

This touches two reusables, so it needs a tag for consumers to get it — and per the org rule, no tag before a consumer PR proves it green. That consumer PR is outside this repository, so I have not opened one.