fix(ci): Lint extensionless scripts, serialize tests, drop pinned URLs

- ShellCheck now also covers bash scripts without .sh (alvin-install,
  choose-mirror, livecd-sound), picked up by shebang.
- concurrency group: the job rewrites the runner's /etc/pacman.conf.
- Import the CachyOS key from the keyserver instead of pacman -U on
  pinned keyring/mirrorlist URLs that break once the mirror prunes them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/tests.yaml

@@ -5,6 +5,12 @@ on:
   pull_request:
   workflow_dispatch:
 
+# This job rewrites the runner's shared /etc/pacman.conf - never let two
+# runs do that at the same time.
+concurrency:
+  group: host-pacman-conf
+  cancel-in-progress: false
+
 jobs:
   tests:
     runs-on: archlinux
@@ -56,14 +62,12 @@ jobs:
 
       - name: Set up CachyOS repo
         run: |
+          # Key straight from the keyserver; no pinned keyring/mirrorlist
+          # package URLs (they 404 once the mirror prunes that version, and
+          # the mirrorlist was overwritten below anyway).
           pacman-key --recv-keys F3B607488DB35A47 --keyserver keyserver.ubuntu.com
           pacman-key --lsign-key F3B607488DB35A47
 
-          pacman -U --noconfirm \
-            'https://mirror.cachyos.org/repo/x86_64/cachyos/cachyos-keyring-20240331-1-any.pkg.tar.zst' \
-            'https://mirror.cachyos.org/repo/x86_64/cachyos/cachyos-mirrorlist-27-1-any.pkg.tar.zst'
-
-          # Fix the mirrorlist URL (pacnew has wrong format)
           printf '%s\n' 'Server = https://mirror.cachyos.org/repo/$arch/$repo' \
             > /etc/pacman.d/cachyos-mirrorlist
 
@@ -112,10 +116,16 @@ jobs:
       - name: Lint shell scripts with ShellCheck
         run: |
           echo "═══════════════════════════════════════════════════════════════"
-          echo "  Running ShellCheck on all .sh files"
+          echo "  Running ShellCheck on all bash scripts"
           echo "═══════════════════════════════════════════════════════════════"
 
-          SH_FILES=$(find . -name '*.sh' -not -path './.git/*')
+          # *.sh plus extensionless bash scripts (alvin-install, choose-mirror,
+          # livecd-sound, ...) picked up by their shebang
+          SH_FILES=$(
+            find . -name '*.sh' -not -path './.git/*'
+            find airootfs/usr/local/bin -type f ! -name '*.sh' \
+              -exec grep -lE '^#!(/usr/bin/env bash|/bin/bash)' {} +
+          )
           if [ -z "$SH_FILES" ]; then
             echo "No shell scripts found."
             exit 0