test: add container test suites and run them in CI (#111)

Adds structure, compat and feature-gated container test suites (test/run.sh), runs them in CI, and gates image publishing on a green test run.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/docker-publish.yml

@@ -21,8 +21,20 @@ env:
 
 
 jobs:
-  build:
+  # Publish gate: the test suite must pass before an image is built and pushed
+  # on master or a release tag. Pull requests already run test.yml directly and
+  # only build here without pushing, so the suite is skipped for them.
+  tests:
+    if: github.event_name != 'pull_request'
+    permissions:
+      contents: read
+    uses: ./.github/workflows/test.yml
 
+  build:
+    needs: tests
+    # A skipped `tests` job (pull requests) would skip `build` as well, hence
+    # the explicit condition. Failed or cancelled tests never publish.
+    if: ${{ !cancelled() && (github.event_name == 'pull_request' || needs.tests.result == 'success') }}
     runs-on: ubuntu-latest
     permissions:
       contents: read

.github/workflows/test.yml

@@ -0,0 +1,61 @@
+name: Test
+
+# Pull requests run this workflow directly. Pushes to master and v*.*.* tags run
+# it as the gate of docker-publish.yml (workflow_call), so the suite runs exactly
+# once per event and an image is never published without it.
+on:
+  pull_request:
+    branches: [ "master" ]
+  workflow_call:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  shellcheck:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Install shellcheck
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y -qq shellcheck
+
+      # The test scripts are new, so they are held to a clean bill of health.
+      - name: Run shellcheck on the test scripts
+        run: shellcheck --severity=warning test/*.sh
+
+      # The image scripts declare #!/bin/sh but use a few bash constructs that
+      # busybox ash happens to accept. Cleaning that up is a separate change,
+      # so this step reports but does not block.
+      - name: Run shellcheck on the image scripts
+        run: |
+          shellcheck --severity=warning backup.sh check.sh entry.sh build.sh run.sh \
+            || echo "::warning::shellcheck reported findings in the image scripts, see the log above"
+
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Build test image
+        run: docker build -t restic-backup-docker:test .
+
+      # container-structure-test is not installed: test/run.sh falls back to
+      # the official tool image, which keeps CI and local runs identical.
+      - name: Run test suites
+        run: bash test/run.sh --no-build
+
+      # Guards the guard: if someone waters the suites down until a broken
+      # backup no longer fails them, this step turns red.
+      - name: Verify the suite detects a broken backup
+        run: bash test/run.sh --sabotage