refactor(CI-CD): adopt helpers4/action shellcheck/pr-status-comment/trigger-website-update

[baxyz]

Summary

• pr-validation.yml:
  • shellcheck job now uses ludeeus/action-shellcheck instead of a hand-rolled apt-get + shellcheck sequence — scoped to scandir: src + ignore_names for path-keys.sh/sync-files.sh/gh-auth.sh to preserve the exact previous scope (only install.sh files were ever linted here; those 3 other scripts have never been checked and may have pre-existing issues out of scope for this PR)
  • The "bootstrap copies match helpers4-common canonical" check stays as its own step — that's devcontainer-specific logic, not shellcheck's job
  • Status-comment block → helpers4/action/pr-status-comment@main; every job's "Set status" boilerplate removed, pr-comment reads needs.<job>.result directly
• release.yml — behavior-preserving but not a pure mechanical extraction, flagging for extra review attention: the old "Trigger website update" step was a bash loop calling gh api .../dispatches once per changed feature inside the release job. Replaced with a new trigger-website job using a dynamic matrix (fromJson(needs.detect.outputs.changed)), one helpers4/action/trigger-website-update@main call per feature — same event-type/payload shape (feature, version, ref, sha, source) as before, same non-blocking behavior (continue-on-error: true at both job and step level, matching the old loop's || echo "⚠️ dispatch failed"), and still gated on release succeeding first (needs: [detect, release]) and only running when count != '0'.
  • Could not dry-run this before opening the PR: unlike typescript's release workflow, this one has no true no-op mode — workflow_dispatch still does a real devcontainers/action publish + real tag push even with force-all: false. Running it as a "test" would have live side effects (GHCR publish, git tags, real website dispatch), so I didn't. First real validation will be the next actual feature version bump that reaches main. Please give this specific job extra scrutiny in review.

Test plan

• CI: pr-validation.yml (shellcheck scope unchanged, pr-status-comment renders)
• Not dry-run-able (see above) — verify release.yml parses/lints cleanly via the Actions tab after push, and watch the next real release closely
• Confirm the sticky PR comment renders correctly

🤖 Generated with Claude Code

[github-actions]

✅ PR Validation Passed

All checks passed!

---

📋 Pipeline Status

	Job	Status
✅	🧾 Conventional Commits	passing
✅	🔖 Version Bump	passing
✅	🧪 Feature Tests	passing
✅	🐚 ShellCheck	passing

---

_{🤖 Generated by @helpers4 CI • 2026-07-28}