Fixes #200 `.github/shellcheck-actions.sh` only reached the two composite actions, so none of the `run:` steps in `.github/workflows/` were ever checked. Changes: - Lint `*/action.yaml` and `.github/workflows/*.yaml`. Enabling `globstar` alone isn't enough, because `**` skips the hidden `.github` directory. - Read steps from both `.runs.steps` (composite actions) and `.jobs.<id>.steps` (workflows), skipping steps without `run:`. - Check each `run:` block on its own, since every step runs as a separate script. Checking a file's steps together produced false SC2317s after steps that `exit`. - Check every file and exit non-zero at the end, so one finding no longer hides the rest. - `$@` → `$*` in `info()` (SC2145). Heads-up: with the workflows included, the script now reports the existing findings described in https://github.com/canonical/starflow/issues/200#issuecomment-6356451509, so `make lint-code` exits 1 until they're addressed. Most are intentional word splitting (`${OSV_EXTRA_ARGS}` and similar) or `${{ }}` expressions inside `run:` blocks, and a few look like real issues (SC2163, SC2045). I kept this PR to the script so it stays reviewable. I'm happy to follow up with disable comments with reasons for the intentional ones and fixes for the real ones, either here or in a separate PR, whichever you prefer. Tested locally with shellcheck 0.11.0: the script itself passes shellcheck, and it now lints both actions and all workflows.