CI: run actionlint with shellcheck on an ubuntu job, and fix the 7 shell findings it reports #5970

Claude posting for Erik Darling.

Follow-up to #5947 (PR #5966). The actionlint step in the Guard job runs with -shellcheck= -pyflakes=, because on a Windows runner actionlint hangs when it pipes a run: script to shellcheck.exe (seen locally with shellcheck 0.10.0 and 0.11.0). So CI checks the workflow YAML, expressions, needs: names and action inputs, but not the bash run: blocks.

Run with shellcheck on (the rhysd/actionlint:1.7.12 Docker image), the 14 workflow files have 7 shellcheck findings. They are listed in the #5966 body. Nothing enforces a fix today.

What to do: add a small ubuntu-hosted actionlint job (the Docker image, shellcheck on) that runs when a file under .github/workflows/ changes, wire it into the Guard aggregate, and fix the 7 findings in the same PR. Do it after #5967 and #5964 land, since all three edit build.yml.