ci: add lint and smoke checks on pull requests

[Sayt-0]

Summary

main is deployed as-is by GitHub Pages and piped into bash, so every pull request is now checked before it can be merged. Two jobs, lint and smoke, run on each pull request and on pushes to main. The Contributing section of the README lists both scripts as a step before opening a PR.

Checks

lint (tests/lint.sh)

• bash -n and ShellCheck (bash dialect, errors only) on every script, including extension-less ones like fake-gcc/gcc
• each manifest entry has its confloose.sh and antidote.sh, each folder is listed in the manifest, no duplicates
• a single fallback URL everywhere, identical to the install.sh default
• no URL outside CONFLOOSE_BASE in confloose/
• every file the scripts download exists in the repo

smoke (tests/smoke.sh)

• serves the repo locally and checks the menu (listing, then apply and undo by number)
• applies and undoes each confloose through install.sh in a throwaway HOME, then requires that HOME to match its initial state exactly (content and file modes)
• the seeded HOME holds user config (.bashrc, i3 config, Alacritty config, a ~/.local/bin/gcc shim) that antidotes must leave intact
• empty environment, no terminal, and stubs for i3-msg, xrandr, xinput, setxkbmap, xkill and i3lock, so it is also safe to run locally
• covers 23 of the 26 confloose; daemon-terminal, i3loop and tchiki start a background daemon and are skipped

Workflow

• permissions: contents: read, pull_request trigger (fork PRs get a read-only token and no secrets)
• actions/checkout pinned by commit SHA (v7.0.1), credentials not persisted

Verification

Scenario	Result
lint.sh on current main, ShellCheck 0.9.0 (runner version) and 0.11.0	pass
smoke.sh on current main	pass, 23 confloose in about 4 s
antidote leaving a file behind (fake-git)	fail, with the diff
antidote not restoring the backup (alacritty-color)	fail, with the diff
confloose that changes nothing (sleep)	fail
downloaded file missing (fake-git)	fail
shared antidote base broken	fail for the 12 confloose using it
diverging fallback URL, foreign URL, missing antidote, unlisted folder, syntax error, missing asset	lint fail

After merge

lint and smoke can be added as required status checks in the Main ruleset; they become selectable once the workflow has run.