CI doesn't validate the container build layer: build the build/* images, shellcheck their scripts, add hadolint

[VijitSingh97]

Summary

CI exercises the dashboard image (docker build --target test ./build/dashboard) and shellchecks only pithead + the two tests/stack/*.sh. The other four images and their scripts are never built or linted — so a broken COPY, missing apt package, stale upstream URL/hash, or a regression in a healthcheck/entrypoint script only surfaces at deploy time.

Gaps

1. Build the other images in CI. .github/workflows/ci.yml never builds build/monero, build/p2pool, build/tor, or build/xmrig-proxy. The Pre-launch hardening sweep (stratum bind, no-new-privileges/cap_drop, healthcheck creds, p2pool healthcheck) #90 hardening added build/monero/healthcheck.sh and build/p2pool/healthcheck.sh that are COPYed into images CI never builds. A build-only matrix job (no nodes/daemon needed at runtime) validates COPY paths, apt installs, and chmod steps.
2. Shellcheck the build scripts. Makefile:17 / ci.yml lint only pithead + 2 test scripts. build/{monero,p2pool}/{entrypoint,healthcheck}.sh, build/tor/healthcheck.sh, and build/dashboard/entrypoint.sh are never linted. They pass shellcheck --severity=warning today, so extending the glob is a zero-friction lock-in. (shebangs vary #!/bin/sh vs #!/bin/bash; shellcheck honors them.)
3. Add hadolint over build/*/Dockerfile (catches unpinned base tags — e.g. build/tor/Dockerfile uses FROM alpine:latest — missing --no-install-recommends, layer-cache issues). Static, seconds, no daemon. Start with a relaxed ignore list so it lands green.

Acceptance

• CI builds all five build/* images.
• make lint + CI shellcheck cover build/*/*.sh.
• hadolint runs over the Dockerfiles (relaxed → tightened).

Related

Distinct from #54 (real-server end-to-end): this is static/build-only validation with no nodes. Directly covers the #90 healthcheck scripts.