STAC-25463 Add GitHub Actions check-test workflow (integrations CI migration phase 1)

[LouisParkin]

Jira: https://stackstate.atlassian.net/browse/STAC-25463 (parent: STAC-25142)

First phase of moving stackstate-agent-integrations CI off GitLab. Purely additive — .gitlab-ci.yml is untouched and keeps running, so this can land without a cutover.

What moved

GitLab	GitHub Actions
the test_<check> job family (20 near-identical jobs)	one check-tests matrix
per-job changes: rules	.github/scripts/select-checks.sh (plain git diff vs merge base)
checksdev validate * riding inside test_stackstate_checks_base	its own validate job
services: docker:24-dind + DOCKER_HOST: tcp://docker:2375	dropped — both public ARC runners already ship a DinD sidecar

Path filtering is done in git rather than a path-filter action because StackVista enforces a strict third-party action allowlist, and git diff against the merge base is precisely what the GitLab rule meant.

Scoped out (each reasoned in the workflow header)

• The 5 Docker-dependent suites — splunk_{base,health,metric,topology} + stackstate_checks_dev. These are the only suites needing a Docker daemon. Phase 2; the runners already provide DinD, so it is about exercising that path, not provisioning it.
• test_postgres — dead config. It tests a postgres check that does not exist in this repository. Dropped, not pending.
• print_env — not ported at any phase. It is a bare printenv, and this repo is public, so it publishes every CI credential in scope to a world-readable log. Same hazard class as the sign_debian_package.sh finding on the agent.
• No Windows lane exists to port. .gitlab-ci.yml defines a .windows_env anchor that no job has ever referenced, and Windows is not a supported target. The orphaned conda_env.ps1 / windows_*.cmd helpers can retire with the GitLab pipeline (STAC-25464).
• Publishing + the runner-image docker job stay on GitLab until integrations gets its own publishing role (pulumi-infra section 7.4).
• Cerberus notify — unlike the agent, this pipeline has never had a notify job, so adding one is new capability, and CERBERUS_LAMBDA_URL is a private-visibility org secret unreadable from a public repo. Follow-up.

Credentials

Phase 1 needs no new secret provisioning: REGISTRY_HOST / REGISTRY_USER / REGISTRY_PASSWORD are org-level visibility: all (STAC-25350) and already reach this public repo. Note the image ref composes vars.REGISTRY_HOST + /docker rather than using vars.REGISTRY_DOCKER_URL, which is private-visibility and not readable here.

Validation

• actionlint clean — added .github/actionlint.yaml declaring the self-hosted *-public labels

• zizmor clean (2 suppressed = the documented unpinned-images ignores on the container ref)

• shellcheck clean

• Selector exercised against real git history:

  scenario	selected
  push / dispatch	all 15
  PR touching only zabbix/	["zabbix"]
  PR touching kubelet/ + vsphere/	["kubelet","vsphere"]
  PR touching a shared library	all 15
  PR touching nothing relevant	[] (matrix skips)

This PR self-validates — the workflow runs against this very PR, so the image path and runner labels are proven before merge.