Add aggregate codebase lint entrypoint

[johnson-ricon]

Summary

• Add codebase lint [target] as the aggregate configured lint entrypoint.
• Share codebase lint config/scope parsing via lib/codebase-config.sh.
• Make generated pre-commit hooks delegate to codebase lint "$REPO_ROOT".
• Generate GitHub Actions lint steps through the aggregate entrypoint.

Verification

• bash -n lib/codebase-config.sh lib/shell-files.sh .mise/tasks/pre-commit .mise/tasks/test .mise/tasks/scan .mise/tasks/migrate/task-pattern .mise/tasks/lint/*
• shellcheck --exclude=SC1091,SC2034,SC2154 lib/codebase-config.sh .mise/tasks/lint/_default .mise/tasks/pre-commit .mise/tasks/lint/github-actions
• mise run test test/lint/default.bats test/lint/relative-paths.bats test/pre-commit/pre-commit.bats test/lint/github-actions/github-actions.bats
• mise run test

[johnson-ricon]

Self-review / parent review complete after Or's review.

I found one issue and pushed 2f313c2 to fix it: lint:github-actions --fix could generate run: codebase lint "$PWD" while leaving an existing old "shiv:codebase" = "0.2.0" pin untouched. That generated workflow would install a codebase version without the aggregate lint entrypoint. The fix now updates existing codebase tooling to latest when emitting aggregate-lint workflows, matching the existing absent-tool provisioning behavior, and adds regression coverage.

Verification after the fix:

• bash -n lib/codebase-config.sh lib/shell-files.sh .mise/tasks/pre-commit .mise/tasks/test .mise/tasks/scan .mise/tasks/migrate/task-pattern .mise/tasks/lint/*
• shellcheck --exclude=SC1091,SC2034,SC2154 lib/codebase-config.sh .mise/tasks/lint/_default .mise/tasks/pre-commit .mise/tasks/lint/github-actions
• mise run test test/lint/default.bats test/lint/relative-paths.bats test/pre-commit/pre-commit.bats test/lint/github-actions/github-actions.bats — 57/57
• mise run test — 212/212
• git diff --check
• GitHub checks after 2f313c2: ubuntu + macOS passed

I don't see remaining blockers.