Add CI that validates and smoke-tests the appliance

[jzonthemtn]

.github/workflows/ contains only docs.yml. Nothing validates the appliance itself, so a change to docker-compose.yaml, bom.yaml, the nginx configuration or the bootstrap script can break the stack and be merged without anything noticing.

Everything currently keeping this working is manual verification.

Acceptance Criteria

• docker compose config is validated for the core, full and tools profiles
• bin/appliance-bom render-env and list run, and a malformed bom.yaml fails the build
• bin/appliance-bom doctor reports registry components that no longer resolve, without failing the build on an unpublished one
• The console image builds
• bin/appliance-bootstrap runs and produces a certificate with the expected subject alternative names
• A smoke test starts the core profile and asserts the console answers over TLS and every probe endpoint responds
• The nginx configuration is validated, so a bad proxy change fails before merge
• Shell scripts pass shellcheck and Python passes a linter
• The workflow runs on pull requests, not only on main

The smoke test is the valuable part. Config validation catches typos; only starting the stack catches a service that no longer talks to its neighbour.