- Validate GitHub Actions workflows and add minimum required permissions

[Copilot]

Summary

Creates GitHub Actions workflows for this repository with security best practices applied.

Changes

New workflows

• check-pr-title.yml – Validates PR titles using blumilksoftware/action-pr-title, runs on pull_request events
• validate-yaml.yml – Validates all YAML files using yamllint, runs on push/pull_request to main
• lint-shell-scripts.yml – Runs ShellCheck on all *.sh scripts, runs on push/pull_request to main

Security hardening

• permissions: {} set at every workflow level (deny-all default)
• Minimum required permissions granted at job level only:
  • pull-requests: read for PR title check
  • contents: read for YAML validation and shell linting
• All uses: actions pinned to full commit SHA (protects against supply-chain attacks)

Supporting files

• .yamllint.yml – yamllint configuration matching existing coding style (allows long lines, optional document-start markers, inline comments with 1 space)

Bug fixes

• Fixed trailing spaces in Taskfile-init.yml (yamllint compliance)
• Fixed ShellCheck warnings in scripts/add-ca-to-trust-store.sh:
  • SC2044: replaced fragile for loop over find output with safe while read loop
  • SC2086: added proper quoting to prevent globbing and word splitting