Fix assist_satellite config and validate app configs in CI

[synesthesiam]

The problem

assist_satellite disappeared from the apps page. Its config.yaml stopped
parsing as YAML:

yaml.scanner.ScannerError: while scanning for the next token
found character '%' that cannot start any token
  in "config.yaml", line 34, column 27

The peripheral options added in 0f7079a left peripheral_volume_step: %(default)s,
copied out of the upstream argparse help string where %(default)s is a format
placeholder rather than a value. % is a reserved YAML indicator and cannot start
a plain scalar. The Supervisor skips an app whose config it cannot read, so the
failure surfaced as the app going missing rather than as an error anywhere.

Fixes

assist_satellite/config.yaml:

• %(default)s → 0.05, upstream's PeripheralAPIServer.DEFAULT_VOLUME_STEP
• peripheral_host schema int → str; it is a bind address, and the 0.0.0.0
  default could never have validated as an int
• peripheral_volume_step schema str → float(0,1), matching upstream's type=float
• added the missing enable_colored_debug: bool; the Supervisor rejects options
  the schema does not define

assist_satellite run script:

• three peripheral flags were wrapped in backticks, so bash tried to execute
  --peripheral-host as a command and appended an empty argument in its place
• --enable-colored-debug → --colored-debug, which is how upstream spells it;
  enabling that option made argparse exit with "unrecognized arguments"

Translations: ten options had no configuration entry and displayed as raw key
names. Five are the new peripheral/colored-debug options; wakeup_sound,
mute_sound, unmute_sound, preferences_file and download_dir predate them.

CI

Neither failure was caught by anything, because there was no CI. This adds two
jobs on pull requests and pushes to main.

App configs — each config.yaml parses; required keys present; every option
has a schema entry and vice versa; each default type-checks against its schema
entry; options match translations/en.yaml. Type checks mirror the Supervisor's
own coercion rules rather than being stricter, so a numeric default under a str
entry is accepted just as the Supervisor accepts it. A non-string version is
rejected, since version: 1.10 parses as the float 1.1 and silently moves the
version backwards. Only English translations must be complete; other languages
are checked for stale keys only, since translations lag by nature.

Shell scripts — shellcheck over every script, found by shebang because the s6
service scripts have no extension and a #!/command/with-contenv bashio shebang
shellcheck does not recognise on its own.

Confirmed both jobs catch the original bugs: the config job reports the YAML error
at line 34 and, with only that repaired, still flags the peripheral_host type and
the undefined enable_colored_debug. shellcheck flags the backticks as SC2215,
"This flag is used as a command name".

Pre-existing shellcheck findings

The shellcheck job would have been red on arrival from findings in default-agent
and voice, so those are fixed here too. Two are real bugs: unquoted
${flags[@]} in both service entry points re-splits and glob-expands each element
(assist_satellite already quoted it correctly), and cd without a failure branch
preceded git reset --hard origin/main in default-agent. The rest follow the
pattern assist_satellite/finish already uses for the same s6 boilerplate.

Version

Left at 1.1.15 deliberately. The break landed at 1.1.14 and predates the 1.1.15
bump, so every commit carrying version: 1.1.15 also had unparseable YAML — it
never entered a store index and nobody can have it installed. The highest
installable version is 1.1.14, so existing installs see 1.1.15 as a normal update
once this merges. The CHANGELOG entry and ARG LINUX_VOICE_ASSISTANT_VERSION already
agree with 1.1.15.

🤖 Generated with Claude Code