Add actionlint CI to lint workflow files (incl. shellcheck on run: blocks)

actionlint lints the GitHub Actions workflows and runs shellcheck on every
run: block. This is the class of bug that bit the freshness PR (set -o pipefail
under the container's dash shell) and would have been caught statically.

Pinned to the official rhysd/actionlint image by version. Also fixes the three
SC2086 findings it surfaced: quote $GITHUB_PATH in the uv-install steps of
python-quality.yml and metpo-content-lint.yml.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: turbomam

.github/workflows/actionlint.yml

@@ -0,0 +1,21 @@
+name: actionlint
+
+# Lints the GitHub Actions workflow files themselves. actionlint also runs
+# shellcheck on every `run:` block, which catches shell bugs in workflows (for
+# example, the `set -o pipefail` that fails under the container's default dash
+# shell, and unquoted variables). Pinned to the official image by version.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  actionlint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Run actionlint
+        run: docker run --rm -v "${{ github.workspace }}":/repo --workdir /repo rhysd/actionlint:1.7.12

.github/workflows/metpo-content-lint.yml

@@ -34,7 +34,7 @@ jobs:
       - name: Install uv
         run: |
           curl -LsSf https://astral.sh/uv/install.sh | sh
-          echo "$HOME/.local/bin" >> $GITHUB_PATH
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
 
       - name: Install dependencies
         run: uv sync

.github/workflows/python-quality.yml

@@ -25,7 +25,7 @@ jobs:
       - name: Install uv
         run: |
           curl -LsSf https://astral.sh/uv/install.sh | sh
-          echo "$HOME/.local/bin" >> $GITHUB_PATH
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
 
       - name: Install dependencies
         run: |
@@ -67,7 +67,7 @@ jobs:
       - name: Install uv
         run: |
           curl -LsSf https://astral.sh/uv/install.sh | sh
-          echo "$HOME/.local/bin" >> $GITHUB_PATH
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
 
       - name: Install dependencies
         run: |