fix(ci): harden the CA refresh script and add shellcheck to CI

Round-2 review findings, all low severity.

- `curl` now has `--connect-timeout` and `--max-time`, so an unreachable API
  server fails the job instead of hanging the runner indefinitely.

- A guard for a kubeconfig with no cluster entries, or an empty one, with a
  clear message rather than an opaque kubectl error.

- The fingerprint mismatch message now prints both the expected and the
  actual value, which cuts the time to diagnose the next CA rotation.

- `set -euo pipefail` was already there; the script now passes shellcheck
  clean, and a shellcheck step was added to the CI test job so the
  operational scripts get the same treatment as the Python code.

.gitea/workflows/build_push.yml

@@ -28,6 +28,16 @@ jobs:
           . .venv/bin/activate
           python -m pytest tests/ -q
 
+      - name: Shellcheck the scripts
+        run: |
+          # The operational scripts are shell, so they get the same treatment
+          # as the Python code.
+          if ! command -v shellcheck >/dev/null 2>&1; then
+            apt-get update -qq
+            apt-get install -y -qq shellcheck
+          fi
+          shellcheck scripts/*.sh
+
   # NOTE: the build job deliberately does NOT have a kubeconfig.  The
   # `KUBEC_CONFIG_BUILDX` secret is cluster-admin-equivalent, and a build step
   # that has no need of the cluster should not be able to read it.  The deploy