Add first-pass lint CI for pgcopydb-helpers and pgcopydb-templates

[teknogeek0]

First pass at CI/linting for the two actively-developed migration paths. Designed to be extended — tighten the gates and add jobs over time.

What runs

Triggers on any push or PR that touches pgcopydb-helpers/**, pgcopydb-templates/**, or the CI config. Three parallel jobs:

• shell — bash -n + shellcheck on all 17 .sh files across both folders.
• cloudformation — cfn-lint on the AWS CloudFormation template.
• terraform — fmt -check, init -backend=false, validate, and tflint, matrixed over the aws and gcp template dirs.

Design notes

• shellcheck gates at --severity=warning with a repo-root .shellcheckrc disabling three codes, each documented as a ratchet point:
  • SC1090 — scripts source ~/.env; the path is dynamic and unresolvable statically.
  • SC2088 — current hits are tildes that are correct by construction (message strings, a bash -c payload).
  • SC2034 — current hits are intentional positional field-skips in read.
• terraform fmt normalizes the two .tf files (alignment-only) so the fmt -check gate passes.
• All actions pinned to full commit SHAs with version comments.

Verification

Every job was run locally against the real tools before opening this PR — all green: shellcheck (exit 0 with the config), cfn-lint 1.52.1 (exit 0), terraform fmt -check/validate (both dirs), tflint 0.61.0 (both dirs).

Follow-ups to build on this: extend shell coverage (lower severity, drop disables as scripts are cleaned), and add behavioral smoke tests with stubbed psql/pgcopydb to catch runtime bugs that static analysis can't (e.g. unbound-variable-under-set -u).

[DmitriiAn]

@teknogeek0

Two follow-ups on the first-pass lint CI.

Pin every linter. Only cfn-lint was pinned; shellcheck came from whatever the
ubuntu-latest image ships, and terraform/tflint resolved to latest at run time.
A new linter release or a runner image bump could therefore turn an unrelated
PR red, and "verified green locally" didn't describe what CI actually ran.
shellcheck is now installed from a pinned release tarball, and terraform/tflint
take explicit versions; all four live in one env: block.

Drop the paths: filter. A paths-filtered workflow does not run at all on a PR
that touches nothing it matches, so its checks never report a status — any of
these jobs marked as a required check in branch protection would sit waiting
forever and block the merge. The jobs are cheap, so they now always run. push
is scoped to main and a concurrency group cancels superseded runs, so a PR
commit triggers one run rather than two.

Also add -recursive to terraform fmt, which otherwise checks only the named
directory and would silently skip any subdirectory added later.

Verified locally at the pinned versions: shellcheck 0.11.0 exits 0 with the
committed .shellcheckrc; terraform 1.15.8 passes fmt -check -recursive and
validate in both template dirs; both pinned release assets resolve.