chore(ci): make lint.yml drop-into-existing-repo friendly

[topcoder1]

Summary

Two fixes for the `install-lint.sh` fanout caught by the first real-world target (whois-api-llc/wxa-jake-ai#181).

Problems

1. actionlint default surfaced N pre-existing shellcheck warnings. The shellcheck integration in actionlint defaults to severity=info, which means dropping the workflow into a repo with N existing `run:` blocks fires N info-level warnings (SC2086 quote-variables, SC2034 unused-variable, etc.) and turns the install PR red. Forcing every new repo to clean up shellcheck noise before shipping a single PR is hostile.

2. prettier --check failed in repos with custom prettier configs that reference plugins (wxa-jake-ai uses `prettier-plugin-svelte`). The lint job ran prettier without installing the target's deps, so the plugin couldn't resolve.

Fixes

Change	Default	Override
Disable actionlint's shellcheck integration	OFF	`run_shellcheck: true`
Run `npm ci` (or `npm install`) before prettier when package.json present	ON	`install_node_deps: false`

Real GHA bugs (typos in `uses:`, undefined steps refs, deprecated runners) are caught by actionlint's native checks regardless. Shellcheck-on-bash is a separate concern best opted into per repo once the codebase is normalized.

After this lands

wxa-jake-ai#181 and wxa_vpn#180 will pass actionlint on the next CI run. Pre-existing markdown drift (separate concern) still needs a `prettier --write` pass per repo or `--no-prettier` install option.

🤖 Generated with Claude Code

[claude]

Script injection via inputs.markdown_glob

${{ inputs.markdown_glob }} is interpolated directly into the shell script body. A caller that passes a value containing shell metacharacters — e.g. **/*.md"; malicious_cmd; echo " — would execute arbitrary code in the runner. This is the injection pattern GitHub's security-hardening guide explicitly warns against.

Fix: bind the expression to an environment variable at the step level and reference that inside run:

      - name: prettier --check ${{ inputs.markdown_glob || '**/*.md' }}
        env:
          GLOB: ${{ inputs.markdown_glob || '**/*.md' }}
        run: |
          if [ -x node_modules/.bin/prettier ]; then
            node_modules/.bin/prettier --check "$GLOB"
          else
            npx --yes prettier@3 --check "$GLOB"
          fi
        shell: bash

With the env-var approach, the expression value is never parsed by the shell as code — it's handed in through the environment.

[claude]

Flagged 1 issue inline — script injection risk at line 121 where inputs.markdown_glob is interpolated directly into the shell body; fix is to bind it to an env var at the step level.

[claude]

Bug: install_node_deps: false is never respected when called via workflow_call.

The condition github.event_name != 'workflow_call' is always true for reusable workflows — the PR itself documents this in the actionlint job comment (lines 68–71): github.event_name in a reusable workflow always returns the caller's event (e.g. pull_request), never 'workflow_call'. So inputs.install_node_deps is never reached, and npm install runs unconditionally whenever package.json is present, even when the caller sets install_node_deps: false.

The fix should use the same pattern as the job-level if: conditions in this PR:

Suggested change

	if: ${{ (github.event_name != 'workflow_call' || inputs.install_node_deps) && hashFiles('**/package.json') != '' }}
	if: ${{ (inputs == null || inputs.install_node_deps) && hashFiles('**/package.json') != '' }}

[claude]

Flagged 1 issue inline — the install_node_deps: false opt-out is never applied when called via workflow_call because github.event_name is always the caller's event, not 'workflow_call'; the step condition should use inputs == null || inputs.install_node_deps (same pattern the job-level if: conditions correctly use).

[claude]

No issues found. Logic for null-input detection, shellcheck opt-in conditional, npm caching guard, and --ignore-scripts security practice all look correct.