ci: add static notebook validation and shell lint pipeline

[bushidocodes]

Summary

Fixes #15. The repo had no CI, so syntax- and dependency-driven regressions went undetected. This adds .github/workflows/ci.yml with two jobs:

• notebook — runs ci/check_notebook.py, a stdlib-only script that confirms My First Malware.ipynb is valid JSON/nbformat and that every code cell parses as Python (ast.parse). Catches the syntax/indentation class of breakage.
• shell-lint — runs bash -n and shellcheck --severity=warning on generateCG.sh.

Scope / honest limitations

The issue suggests executing the notebook end-to-end. That is not feasible on GitHub-hosted runners: the notebook needs a CUDA GPU and the ~20k-APK AMD dataset (../amd_data). So this pipeline does the static checks that don't need either. I documented this directly in the workflow header.

Importantly, a static check (or even a dependency import smoke test) would not have caught the historical fn.copy_src removal — only executing the cell does, since it's a runtime AttributeError. I deliberately did not add a deps-install/import job that would imply otherwise; full execution belongs in a future nbmake/papermill job on a self-hosted GPU runner with the dataset mounted (and after the remaining legacy DGL calls are modernized).

Verification

• python ci/check_notebook.py "My First Malware.ipynb" → OK (exit 0) locally.
• Negative test: injected a deliberately broken cell → checker exits 1 and names the cell. So the gate is not a no-op.
• Workflow YAML parses (yaml.safe_load).
• The Actions run triggered by this PR is the live verification of both jobs on a real runner — I'll confirm it goes green.

🤖 Generated with Claude Code