ci: replace raven-actions/actionlint with Docker container action

[derekmisler]

What

Replace the raven-actions/actionlint composite action with a Docker container step using the official rhysd/actionlint image.

Why

raven-actions/actionlint internally runs npm install as part of its setup. This conflicts with pnpm's node_modules layout on cold caches, causing intermittent CI failures in the lint job.

The Docker container approach is cleaner: no curl, no tar, no SHA file verification — the image is pinned by its multi-arch digest (supports both amd64 and arm64 runners). GitHub Actions automatically mounts the workspace and sets the working directory, so actionlint discovers .github/workflows/ automatically.

Changes

• .github/workflows/test.yml: swap uses: raven-actions/actionlint for uses: docker://rhysd/actionlint:1.7.12@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667
• -shellcheck= disables shellcheck integration, matching the previous shellcheck: false behaviour

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[docker-agent]

Assessment: 🟢 APPROVE

This PR cleanly replaces the raven-actions/actionlint composite action wrapper with a direct Docker container step using the official rhysd/actionlint:1.7.12 image.

All hypotheses verified as non-issues:

• ✅ docker://image:tag@sha256:digest format — Valid Docker canonical reference syntax; GitHub Actions runner strips the docker:// prefix and passes the remainder directly to Docker, which supports this combined form. The digest pins the image while the tag serves as a human-readable hint.
• ✅ SHA-256 digest length — The digest b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667 is exactly 64 hex characters (confirmed by direct measurement).
• ✅ with: args: forwarding — For inline docker:// steps (no companion action.yml), the GitHub Actions runner source (ContainerActionHandler.cs) falls through to Inputs.GetValueOrDefault("args"), correctly forwarding -shellcheck= -color to the container entrypoint.
• ✅ -shellcheck= flag — Confirmed valid: actionlint's -shellcheck string flag accepts an empty string to disable shellcheck integration.
• ✅ -color flag in CI — Valid flag that forces ANSI color output; GitHub Actions workflow logs render ANSI codes as colored text.
• ✅ Failure propagation — actionlint exits non-zero on lint errors by default; GitHub Actions propagates container exit codes, so CI will still fail on lint errors without needing an explicit fail-on-error wrapper.

The approach is correct and functionally equivalent to (or better than) the previous wrapper — no npm install, no indirect toolchain dependency, and the digest-pinned image provides reproducible builds.