Pin shared workflows to v1.2.3 (ADR-0005)

[cpitzi]

Part of lentago/shared-workflows#64

Summary

lentago/shared-workflows ADR-0005 (docs/adr/0005-immutable-semver-tags-replace-main-consumption.md) requires callers to consume reusable workflows at immutable semver tags rather than @main, so an upstream change cannot alter this repo's CI without a reviewed bump here. v1.2.3 (shared-workflows commit 43b4fe4) is used rather than v1.2.2 because it carries the Dependabot action bumps merged after v1.2.2 (shared-workflows#56, #59); pinning to v1.2.2 would roll those back for callers currently tracking main.

• Pin: claude.yml and docs-check.yml move from @main to @v1.2.3. tf-lint.yml is already on a tag (@v1.2.2) and is left as is; third-party SHA pins are untouched.
• Review stub retired: .github/workflows/claude-code-review.yml is deleted. It has been workflow_dispatch-only since 2026-06-25, CodeRabbit is now the org-wide advisory reviewer, and the stub is not a required status context (checked against dotgithub/fleet-ops/required-checks.json and the live main ruleset).
• ShellCheck added: new .github/workflows/shellcheck.yml calls shellcheck.yml@v1.2.3 on pull_request (opened, synchronize, ready_for_review, reopened) with no on: path filter, mirroring kalmia's caller. No scripts input is passed, so the reusable discovers every tracked *.sh. Tracked scripts: modules/alb-log-shipper/build.sh, scripts/bootstrap/bootstrap-backend.sh, scripts/setup-crostini-lab.sh, scripts/standup.sh, scripts/teardown.sh.

Verification

Local shellcheck --severity=warning --shell=bash (0.11.0) passes on all five tracked scripts; local grep confirms no @main shared-workflows refs remain; the v1.2.3 docs link checker passes locally. This is a CI-only change, so the terraform changes job should skip plan/apply.

🤖 Generated with Claude Code

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: Repository: lentago/coderabbit/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2228d1b2-3168-4e01-85cd-df2af10ad97d

📥 Commits

Reviewing files that changed from the base of the PR and between 336fe2c and 1951667.

📒 Files selected for processing (4)

• .github/workflows/claude-code-review.yml
• .github/workflows/claude.yml
• .github/workflows/docs-check.yml
• .github/workflows/shellcheck.yml

 _____________________________________
< Please step away from the keyboard! >
 -------------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}