Add encrypted SSH key setup, known hosts pinning, and CI validation

[junminahn]

Summary

This change modernizes the GitHub Action to securely decrypt and load SSH keys, pins GitHub host verification by default, and adds local/CI validation around the shell-based workflow.

What changed

Action behavior

• The action now reads configuration from environment variables instead of a positional argument.
• The private key is decrypted through a temporary pass file rather than passing the secret on the command line.
• The action now supports an optional known_hosts input.
• GitHub host verification is pinned by default using a committed known_hosts/github.com file.
• The decrypted private key and temporary pass file are cleaned up after use.
• The action validates required commands and emits clearer error messages when the encrypted key is missing.

CI and developer workflow

• Added a CI workflow with:
  • shell linting
  • an integration-style validation step that generates a temporary encrypted key and exercises the action
• Added local lint and test targets to the Makefile.
• Added shellcheck to pre-commit and tool version management.
• Tightened shell safety in the helper scripts.

Documentation and repository hygiene

• Expanded the README with usage, inputs/outputs, key preparation steps, local verification, and troubleshooting guidance.
• Added ignore rules for generated secret material.
• Added an Apache 2.0 license file.

Validation

The new smoke test and CI workflow exercise the end-to-end flow:

• generate a temporary encrypted private key
• decrypt it through the action
• start the SSH agent
• verify the agent socket and loaded identity
• confirm the committed known_hosts file is used

Notes

The new default flow keeps GitHub host verification deterministic and removes the need to place the encryption key in a process argument, improving both ergonomics and security.