ci: parallelize isolated test shards and separate lint

[LucaLin233]

Summary

• Run ShellCheck independently from tests.
• Run isolated motd, push, and other shards on both Ubuntu 24.04 and Debian 13. Unknown/new suites automatically belong to other; PR selection intersects each shard; unavailable Git history still runs all suites across shards.
• Preserve existing required-check names with fail-closed aggregation and disable matrix fail-fast so both platforms retain full diagnostic coverage.
• Keep standalone child-shell errexit, suite assertions, timeouts, main full coverage, and PR incremental selection unchanged.

Evidence and validation

Baseline main run 34264761652: 13m28s overall; Ubuntu tests 713s, including MOTD 384s and push suites 289s; ShellCheck 83s. Debian tests 616s, including MOTD 331s and push suites 251s. Dependency installation took 8s, so caching is not the primary opportunity. Sharding should bring the critical path near the slowest suite plus runner overhead, not guarantee 4–6 minutes.

Local inert-fixture tests passed: test-shards.sh, test-selection.sh, test-selection-git.sh, test-lint-coverage.sh; Bash syntax and git diff --check passed. Production suites are intentionally validated only on isolated CI runners, without local credentials. This workflow change forces full PR coverage. More concurrent jobs and modest setup overhead are expected.

Rollback

Revert this commit to restore the previous two-job workflow and serial test runner. No branch protection or production configuration changes.

[LucaLin233]

Validation completed on 55756a3: run 34269949546 passed all 9 jobs in 5m42s, compared with baseline 34264761652 at 13m28s (57.7% less wall time in this sample). Logs confirm full=true on all six shards and all 13 suites executed exactly once per OS. Both legacy-named aggregate checks passed. Local inert-fixture regression tests also passed. This is a single-run comparison; runner variation contributes (Ubuntu MOTD 325s vs 384s baseline). No assertions or production scripts changed; main and branch protection remain untouched. Ready for review; not merged.