ci: split actionlint into separate steps for handwritten and generated workflows

Disable ShellCheck globally for the cargo-dist generated release workflow to replace brittle regex ignore patterns with a cleaner configuration.

.github/workflows/supply-chain.yml

@@ -60,11 +60,19 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Run actionlint
-        uses: raven-actions/actionlint@205b530c5d9fa8f44ae9ed59f341a0db994aa6f8 # v2
+      - name: actionlint handwritten workflows
+        uses: raven-actions/actionlint@205b530c5d9fa8f44ae9ed59f341a0db994aa6f8
         with:
-          # release.yml is generated by cargo-dist. Keep actionlint enabled for it,
-          # but ignore generated ShellCheck style/info noise from that file only.
-          flags: >-
-            -ignore \.github/workflows/release\.yml:[0-9]+:[0-9]+:.*SC2086
-            -ignore \.github/workflows/release\.yml:[0-9]+:[0-9]+:.*SC2129
+          files: >-
+            .github/workflows/actions-security.yml,
+            .github/workflows/ci.yml,
+            .github/workflows/osv-scanner.yml,
+            .github/workflows/rust-clippy.yml,
+            .github/workflows/semver.yml,
+            .github/workflows/supply-chain.yml
+
+      - name: actionlint generated release workflow
+        uses: raven-actions/actionlint@205b530c5d9fa8f44ae9ed59f341a0db994aa6f8
+        with:
+          files: .github/workflows/release.yml
+          shellcheck: false