ci: replace some third-party actions

[kolyshkin]

Two independent cleanups in the validate workflow, each replacing a
third-party action with a few lines in-tree.

1. commit job: simplify the subject length check

Replace two third-party actions (tim-actions/get-pr-commits and
tim-actions/commit-message-checker-with-regex) with a plain checkout of the
PR head plus a few lines of shell.

Checking out the PR head sha (rather than the default merge commit) means
git log -N walks exactly the PR commits, and a shallow fetch of the same
depth is all we need. The GITHUB_TOKEN permissions are no longer needed
either.

Two details worth noting for review:

• The if is kept at the step level rather than the job level, so that the
  job still succeeds (with its steps skipped) for non-PR events. A skipped
  job would cascade and skip all-done.
• git log output is assigned to a variable before grepping it, rather than
  piped. In a pipeline, a git failure is masked: grep exits 1 when it
  finds nothing, and that is also what a failing git looks like from the
  if. set -o pipefail does not help, as it returns the rightmost
  non-zero status, which is grep's. With the assignment, a git failure
  fails the step via the default bash -e.

Verified on this PR and on a fork:

• passing case: the job checked out the PR head and grepped the actual
  subject(s);
• failing case: a temporary commit with a 100-character subject was flagged
  (and only that one), exiting 1;
• non-PR case: a workflow_dispatch run has both steps skipped and the job
  concluding success, so all-done is not skipped.

2. shellcheck job: drop lumaxis/shellcheck-problem-matchers

That action does nothing but ship a JSON file and echo an ::add-matcher::
command, so we now do that ourselves, with the matcher in
.github/shellcheck-tty.json.

Its matcher was also only annotating warning and error findings, for two
reasons: its severity capture group lists (note|warning|error), while
shellcheck severities are error, warning, info and style; and the
runner honors only error, warning and notice, silently skipping any
other match (Runner.Worker/Handlers/OutputManager.cs). As info and
style are the bulk of what shellcheck reports, most findings were never
annotated. Ours uses a fixed severity instead (any finding fails the job
anyway) and keeps the severity word in the message.

Verified on a fork PR, on a file with four shellcheck problems (one info,
one style, two warning):

• no matcher at all: no annotations, just the generic "Process completed with
  exit code 2";
• upstream matcher: 2 of 4 annotated;
• this one: all 4, at the right file and line.

Note that the usual gcc-format matchers have the same problem, as shellcheck -f gcc reports both info and style as note, which is not notice.

🤖 Generated with Claude Code

[kolyshkin]

This is part of workflow hardening; PTAL @opencontainers/runc-maintainers