ci: add shellcheck linter for ci scripts (#7331)

## Summary

Adds [shellcheck](https://www.shellcheck.net/) to the PR linting CI
steps -- when a PR has changed a `*.sh` file.

┆Issue is synchronized with this [Notion
page](https://www.notion.so/PR-7331-ci-add-shellcheck-linter-for-ci-scripts-2c66d73d365081be889bf256cde92281)
by [Unito](https://www.unito.io)

.github/workflows/ci-shell-validation.yaml

@@ -0,0 +1,26 @@
+# Description: Runs shellcheck on tracked shell scripts when they change
+name: "CI: Shell Validation"
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - '**/*.sh'
+  pull_request:
+    paths:
+      - '**/*.sh'
+
+jobs:
+  shell-lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Install shellcheck
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y shellcheck
+
+      - name: Run shellcheck
+        run: bash ./scripts/cicd/check-shell.sh