K-114: input validation in build.func + mini CI (nexus-hub card)

- validation helpers: sanitize_input trims CR/edge whitespace only;
  embedded control/non-ASCII bytes FAIL validation and re-prompt with a
  hint (2026-06-11 incident: invisible byte in a pasted VLAN tag broke
  pct create mid-run) - never silently stripped
- prompt_lxc_config: every prompt validated (uint for CTID/disk/cores/
  RAM, VLAN 1-4094, hostname/token formats, IP/CIDR/gateway, DNS list);
  env-provided values are sanitized + validated too (abort, no re-prompt
  loop in non-interactive use); helpers reusable for app prompts
- tests/test_validation.sh: 34 cases incl. the 2<0x80>0 repro, re-prompt
  simulation, BASH_REMATCH clobbering regression (is_cidr), env dry-run
  of prompt_lxc_config without PVE/TTY
- tests/check_ct_source.sh: every ct/*.sh must source build.func (bug
  shipped twice); negative proof via prepared fixture in the test suite
- .gitea/workflows/ci.yml: bash -n over all scripts, source-check,
  validation tests, shellcheck if present (documented skip otherwise)
- README: contributions via PR with cross-review (binding)

.gitea/workflows/ci.yml

@@ -0,0 +1,46 @@
+name: CI
+
+# K-114 (nexus-hub): Mini-CI für proxmox-scripts — Syntax, build.func-Source-
+# Pflicht und Validierungs-Unit-Tests. Läuft auf dem nexus-Runner (Host-Mode).
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  lint:
+    name: Shell-Lint (bash -n, source-check, Validierungs-Tests)
+    runs-on: nexus
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: bash -n über alle Scripts
+        run: |
+          status=0
+          for f in ct/*.sh install/*.sh lib/*.func tests/*.sh; do
+            if bash -n "$f"; then
+              echo "ok     $f"
+            else
+              echo "SYNTAX $f" >&2
+              status=1
+            fi
+          done
+          exit "$status"
+
+      - name: build.func-Source-Check (jedes ct/*.sh)
+        run: bash tests/check_ct_source.sh
+
+      - name: Validierungs-Unit-Tests (lib/build.func)
+        run: bash tests/test_validation.sh
+
+      - name: shellcheck (falls auf dem Runner installiert)
+        run: |
+          if command -v shellcheck >/dev/null 2>&1; then
+            # -S warning: Style-Hinweise nicht blockierend; externe Sources
+            # (curl|source) kann shellcheck nicht folgen.
+            shellcheck -S warning -e SC1090,SC1091 ct/*.sh install/*.sh tests/*.sh
+          else
+            echo "shellcheck nicht installiert — übersprungen (dokumentiert, K-114)"
+          fi