fix: actionlint config placement + shellcheck disable scope

- Move actionlint.yaml to .github/ where rhysd/actionlint Docker action finds it
- Move shellcheck disable=SC2086 to top of script block (covers both loops)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.github/actionlint.yaml

@@ -0,0 +1,3 @@
+self-hosted-runner:
+  labels:
+    - ubicloud-standard-2

.github/workflows/evals.yml

@@ -149,6 +149,7 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
+          # shellcheck disable=SC2086
           RESULTS=$(find /tmp/eval-results -name '*.json' 2>/dev/null | sort)
           if [ -z "$RESULTS" ]; then
             echo "No eval results found"
@@ -157,7 +158,6 @@ jobs:
 
           TOTAL=0; PASSED=0; FAILED=0; COST="0"
           SUITE_LINES=""
-          # shellcheck disable=SC2086  # intentional word splitting
           for f in $RESULTS; do
             T=$(jq -r '.total_tests // 0' "$f")
             P=$(jq -r '.passed // 0' "$f")