feat: add explicit shell execution modes

[Mresyzz]

Summary

This pull request introduces explicit shell execution modes (--shell posix|shebang|auto) to OpsScript Gate and hardens the GitHub Action input handling.

Key Changes

• Execution Modes (--shell):
  • posix (default): Strictly executes with /bin/sh, ignoring any script shebang (preserving backward compatibility).
  • shebang: Strictly honors recognized shebang interpreters (#!/bin/sh, #!/bin/bash, #!/usr/bin/sh, #!/usr/bin/bash, #!/usr/bin/env sh, #!/usr/bin/env bash). Fails with a clear error if the shebang is missing, malformed, or unsupported.
  • auto: Honors recognized shebangs if present; safely falls back to /bin/sh if no shebang is present. Unsupported or malformed shebangs fail with an error instead of silently running as POSIX.
• Exact Interpreter-Path Preservation:
  • Distinguishes /bin/bash from /usr/bin/bash and /usr/bin/env bash via fixed constant container commands (SUPPORTED_SHEBANG_COMMANDS) to prevent $PATH resolution masking missing interpreter paths.
  • POSIX mode completely bypasses shebang inspection; run_matrix parses the shebang once upfront for non-POSIX modes.
  • Sanitizes raw shebang text in error diagnostics (strips control chars, collapses whitespace, limits length to 200 chars).
• GitHub Action Input Hardening:
  • All Action inputs (script-path, matrix, timeout, format, shell) are passed securely via step environment variables instead of inline string interpolation in bash scripts.
• Testing & Coverage:
  • Expanded unit test suite to 37 passed tests.
  • Added dedicated Docker integration tests in CI workflow (.github/workflows/test.yml) to verify real container behavior (e.g. bash missing on Alpine 3.20) on GitHub-hosted ubuntu-latest.
  • Integration tests continue to skip cleanly in local environments without Docker.
• Development Constraints:
  • Package version strictly remains 0.1.2 during development.