fix: smoke test image tag v-prefix mismatch (#101)

* fix: smoke test uses semver tag (0.4.0) not git ref (v0.4.0)

github.ref_name = v0.4.0 but Docker metadata strips the v prefix,
so the image is tagged 0.4.0. Use steps.meta-alpine.outputs.version
which matches the actual image tag.

* ci: add actionlint to catch workflow syntax errors on PRs

Prevents broken release.yml from reaching main. Catches: syntax errors
in run scripts, invalid step output references, missing image names,
and other GitHub Actions misconfigurations.

.github/workflows/ci.yml

@@ -31,6 +31,17 @@ jobs:
         run: cargo test --package nora-registry
 
 
+  lint-workflows:
+    name: Lint Workflows
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - name: Install actionlint
+        run: bash <(curl -s https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
+      - name: Run actionlint
+        run: ./actionlint -ignore "shellcheck reported issue" -ignore "SC[0-9]"
+
+
   coverage:
     name: Coverage
     runs-on: ubuntu-latest