Lint the workflow files in CI

[TarikGul]

ci.yml carries a fair amount of inline shell, and nothing in this repo
lints it. No workflow references actionlint or shellcheck, so a quoting or
expansion mistake in a run: block is only caught by whoever happened to
run a linter locally.

Add a job that lints the workflows themselves.

• actionlint over .github/workflows/, which runs shellcheck on run: blocks
• Gate it behind a path filter on .github/**
• Add it to the required list in ci-status
• Clear or annotate the existing finding on the disabled e2e job

The last one is the only pre-existing failure: if: false on e2e trips
if-cond. It is deliberate, so either drop the if: and leave the job
commented out, or ignore that one rule.