refactor: extract inline bash into testable scripts with CI pipeline

Extract all inline bash logic from action.yml into separate script files
under scripts/, add 64 bats-core tests, shellcheck linting, and a CI
workflow. Replace curl-based GitHub Deployment creation with
actions/github-script using Octokit for type safety and automatic
retry/rate-limiting.

Key changes:
- Extract tag generation, architecture verification, image retagging,
  and GitOps update logic into individual scripts
- Add shared utility library (logging, retry with backoff, validation)
- Deduplicate 4x identical file-update loops into process_file_updates()
- Replace manual curl+jq deployment creation with actions/github-script
- Improve git push retry: exponential backoff (5 attempts) instead of
  simple chaining (3 attempts)
- Fix shellcheck warnings (SC2206: array=($line) -> read -r)
- Add CI pipeline: shellcheck, bats tests, action structure validation

All inputs (29), outputs (3), and step IDs remain unchanged.
Consumers do not need to modify their workflows.

Co-Authored-By: Claude <claude@anthropic.com>

Author: 0x46616c6b

.github/workflows/ci.yml

@@ -0,0 +1,62 @@
+name: CI
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  shellcheck:
+    name: Shellcheck
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Run shellcheck on all scripts
+        run: find scripts/ -name '*.sh' -exec shellcheck --severity=warning {} +
+
+  test:
+    name: Bash Tests
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Install bats and helpers
+        run: |
+          sudo npm install -g bats
+          git clone --depth 1 https://github.com/bats-core/bats-support.git tests/test_helper/bats-support
+          git clone --depth 1 https://github.com/bats-core/bats-assert.git tests/test_helper/bats-assert
+
+      - name: Run tests
+        run: bats tests/*.bats
+
+  validate-action:
+    name: Validate Action Structure
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Verify all referenced scripts exist
+        run: |
+          grep -oP 'github\.action_path \}\}/\K[^ "]+' action.yml | while read -r script; do
+            if [[ ! -f "$script" ]]; then
+              echo "::error::Script referenced in action.yml does not exist: $script"
+              exit 1
+            fi
+          done
+
+      - name: Verify scripts are executable
+        run: |
+          find scripts/ -name '*.sh' | while read -r script; do
+            if [[ ! -x "$script" ]]; then
+              echo "::error::Script is not executable: $script"
+              exit 1
+            fi
+          done

.gitignore

@@ -1,2 +1,14 @@
 # Intellij
 .idea/*
+
+# Node
+node_modules/
+package.json
+package-lock.json
+
+# Test helper libraries (installed during CI/local setup)
+tests/test_helper/bats-support/
+tests/test_helper/bats-assert/
+
+# Test artifacts
+headers.txt

.shellcheckrc

@@ -0,0 +1,2 @@
+shell=bash
+external-sources=true