Investigate hash checks for shellcheck installation in CI

We should probably check that what we downloaded matches a specified hash, to prevent this being a supply chain attack route. But I'll grant you that the original action didn't do this, so this strictly isn't making things worse.

_Originally posted by @EliteTK in https://github.com/astral-sh/uv/pull/17532#discussion_r2699543921_

Start by locating the CI workflow that installs ShellCheck and inspect how its download is verified. Determine whether a specified hash can be checked and what the expected CI behavior should be; no file or test is named in the issue.

Written by the indexing model from the issue text.