Add more CI validations beyond "configcheck"

[artemnikitin]

Background

PR #8 improved CI substantially by adding configcheck and real multi-arch rootfs builds. That covers Firework runtime semantics and the full image pipeline, but there are still gaps around repo-specific CI-only fields, workflow correctness, and shell-script regressions.

In particular:

• configcheck validates Firework runtime config, but it does not validate this repo's CI-only fields such as source_image and rootfs_size_mb.
• scripts/build-images.sh currently skips services that do not set source_image, which can hide mistakes.
• The workflow now has more moving parts: matrix builds, artifact handoff, split S3/GCS upload paths, and GCP OIDC auth.

Proposed validations

1. Add a repo-specific tenant validation step.

   • Enforce source_image presence for services that are expected to produce rootfs images.
   • Enforce rootfs_size_mb > 0.
   • Catch obvious image/output naming mismatches.
   • Enforce repo policy around metadata.subdomain vs metadata.host where applicable.

2. Add actionlint for .github/workflows/build-images.yaml.

3. Add shellcheck and bash -n for:

   • scripts/build-images.sh
   • scripts/docker-to-rootfs.sh
   • scripts/push-images.sh

4. Add a fast manifest preflight for every source_image.

   • Use docker buildx imagetools inspect to fail early when an upstream image is missing linux/arm64 or linux/amd64.

5. Add a mocked smoke test for scripts/push-images.sh.

   • Verify GCS path selection when GCS_IMAGES_BUCKET is set.
   • Verify S3 path selection when S3_IMAGES_BUCKET is set.
   • Verify the script fails cleanly when neither is set.

6. Optionally add yamllint for general YAML hygiene.

   • Low priority compared with the semantic checks above.

Acceptance criteria

• CI fails on malformed repo-specific tenant config even when Firework runtime config would still pass.
• Workflow syntax regressions are caught before merge.
• Shell-script regressions are caught before merge.
• Missing per-arch upstream image manifests fail fast with a clear error.
• Upload-path selection logic is covered by a small deterministic test.

Notes

The highest-value additions are items 1-3. Those close the most meaningful gaps without making CI much heavier.