ci: run shellcheck over workflow run: blocks

#619 added actionlint to `make lint`, with the shellcheck and pyflakes integrations pinned off:

```
actionlint -shellcheck= -pyflakes=
```

That was deliberate. GitHub-hosted runners ship shellcheck and most workstations do not, so leaving the integration at its default would make `make lint` mean one thing in CI and another locally. It also means an unknown number of pre-existing findings across ~20 workflow files would have landed in a PR that was about something else.

Enabling it is worth doing on its own terms:

- decide how shellcheck gets onto a developer machine (add to `install-tools`? document it? make the check conditional and say so?)
- work through the findings, most likely SC2086-style quoting in `run:` blocks
- turn it on in `Makefile`'s `lint-actions` target

The value is real: `run:` blocks in `release-upgrade.yaml` and `nightly.yaml` do cluster surgery and publish releases, and they get less review attention than Go code because they are embedded in YAML.

Start with the Makefile's lint-actions target and the existing actionlint command, then inspect the shell commands in release-upgrade.yaml and nightly.yaml. Review how install-tools handles developer dependencies before choosing the documented or conditional ShellCheck setup. Done means the workflow run blocks are checked, findings are addressed, and lint-actions enables ShellCheck consistently.

Written by the indexing model from the issue text.