fix: smoke test image tag v-prefix mismatch (#101)

* fix: smoke test uses semver tag (0.4.0) not git ref (v0.4.0)

github.ref_name = v0.4.0 but Docker metadata strips the v prefix,
so the image is tagged 0.4.0. Use steps.meta-alpine.outputs.version
which matches the actual image tag.

* ci: add actionlint to catch workflow syntax errors on PRs

Prevents broken release.yml from reaching main. Catches: syntax errors
in run scripts, invalid step output references, missing image names,
and other GitHub Actions misconfigurations.

.github/actionlint.yaml

@@ -0,0 +1,3 @@
+self-hosted-runner:
+  labels:
+    - nora