ci(lint): always run shellcheck (scripts) on this repo's own self-test runs

[topcoder1]

Summary

The 2026-07-21 fleet rollout enforced shellcheck (scripts) on all 29 consumer repos, but the central repo itself never ran the job: its gate format('{0}', inputs.run_shellcheck_scripts) == 'true' can never fire on this repo's own pull_request/push self-test triggers, where the inputs context is null.

Verified before changing anything:

• The latest PR-triggered Lint run (29557547790) and merged PR fix(automerge): fail closed on unreadable manual-hold signals — retry×3 + cross-page timeline aggregation #122's check rollup both show shellcheck (scripts): SKIPPED.
• Nothing else lints the repo's own shell scripts: no pre-commit/husky/Makefile, selftest/ and scripts/ never invoke shellcheck, and the only other "shellcheck" mention in the repo is a # shellcheck disable=SC2001 directive comment in pr-classify.yml. actionlint's shellcheck integration is also off on self-test runs (-shellcheck=).

Change

Widen the existing job's if: instead of duplicating the ~40-line file-collection logic into a standalone self-test job:

if: ${{ format('{0}', inputs.run_shellcheck_scripts) == 'true' || (github.repository == 'topcoder1/ci-workflows' && format('{0}', inputs.run_shellcheck_scripts) == '') }}

• Self-test runs (pull_request/push on this repo): the inputs context is null → the input stringifies to '' → job runs. The job body already handles null inputs (|| 'error', || '.'), so it runs at severity=error over the full tree — identical to what fleet callers get.
• Callers: unaffected. A workflow_call input always stringifies to 'true'/'false' (omitted inputs resolve to their declared defaults), and the github.repository conjunct pins the new arm to this repo even if that semantic ever drifted. Same self-detection pattern the draft-gate-triggers job already uses.

Verification

• shellcheck -S error locally over all 12 repo shell scripts (3 in scripts/, 9 in selftest/), collected with the job's exact find logic: clean, exit 0 — the job lands green. (Exactly one advisory exists at warning severity; severity stays error for fleet parity.)
• actionlint (with -shellcheck=, matching CI): clean. prettier --check on lint.yml: clean. selftest/check_draft_gate_triggers.py: OK. Full selftest suite: 39 passed.
• This PR is itself the end-to-end test: shellcheck (scripts) should report success (not skipped) in this PR's checks for the first time.

Non-goals: scripts/tests/*.bats stay uncovered (bats DSL; the fleet job doesn't collect those either). The check stays non-required like the other lint jobs — the ruleset currently requires only review / Claude Review.

Auto-merge rationale: manual-merge category — touches .github/workflows/** (production infrastructure), and PRs to ci-workflows itself are always manual-merge per fleet policy.
Codex rounds: 2 (both clean; round 2 was adversarial on the GHA expression semantics and independently confirmed the ''-arm / caller-default analysis).

🤖 Generated with Claude Code

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[github-actions]

Coverage Floor — mode: enforce

metric	value
measured	100.0%
floor (current)	99.0%
target	100.0%
last bumped	2026-05-12

[claude]

No issues found. One-line if: widening is correct — self-test events give null inputs (→ '' arm fires, pinned to this repo), callers still resolve to 'true'/'false', and the job body's || 'error' / || '.' fallbacks cover null inputs. Consistent with the existing draft-gate self-detection pattern.