## Why The upcoming Starbase merge wires `actionlint` into CI/lint for the first time via a new `lint-actions` Make target and a new `.github/actionlint.yaml` config. This PR fixes the findings `actionlint` (and `zizmor`) surface against workflows on `main` today, so the merge lands with a clean run. It intentionally does not add `.github/actionlint.yaml` itself — that config is Starbase's own tool wiring and belongs in that merge, not here. ## What - `spread.yaml` / `tests.yaml`: remove `paths-ignore` from the `merge_group` trigger (actionlint flags this combination as invalid — `paths-ignore` has no effect on `merge_group` events) - `spread.yaml` / `spread-docs.yaml`: quote unquoted shell expansions (`$(spread -list ...)`, `$(go env GOPATH)`) flagged by shellcheck via actionlint - `schema.yaml`: quote `$CHARMCRAFT_JSON` and `$proj_file` in the ajv validation loop - `spread-docs.yaml`: bind `matrix.system` to an `env:` var instead of interpolating it directly into the `run:` shell script, fixing a `zizmor` `template-injection` finding ## Validation - `actionlint`: exit code 0, zero findings (verified locally with a temporary, uncommitted `actionlint.yaml` declaring the self-hosted runner labels already in use, since actionlint needs that config to avoid unrelated "unknown label" noise across the whole repo — that file is not part of this PR) - `uvx zizmor .github/workflows/spread-docs.yaml`: confirms the `template-injection` finding is resolved; remaining findings (`artipacked`, `excessive-permissions`, `unpinned-uses`) are pre-existing and out of scope for this PR - All touched YAML files validated with `python3 -c "import yaml; yaml.safe_load(...)"`