ci: add Justfile + lint gate (markdown/shell/yaml/actions)

Mirror the homeserver repo's lint setup. Add a `Justfile` with
lint-md/lint-sh/lint-yaml/lint-actions recipes (and a `lint` aggregate +
fix recipes), an `.github`-style `.markdownlint.json`, and a `lint` job in
ci.yaml that runs `just lint` on the plain runner and gates the Gentoo
`build` job via `needs: lint`.

The overlay has no custom runner labels (workflows use ubuntu-latest), so
lint-actions calls actionlint without a -config-file, and no
.github/actionlint.yaml is needed. Also add the blank line before a list in
CLAUDE.md that markdownlint (MD032) flagged, and make the .markdownlint.json
referenced by .yamllint.yaml's comment actually exist.

All linters pass locally.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018MsAYv5RhNLE54fPrviVgS

CLAUDE.md

@@ -25,6 +25,7 @@ fetched at build time. Instead they are vendored ahead of time:
    verifies against the Manifest, then compiles offline from `vendor/`.
 
 Consequences when editing the ebuild:
+
 - `LICENSE` must cover **every vendored module's** license, not just upstream's MIT.
   The bump PR checklist suggests `go-licenses report ./...` to confirm.
 - `BDEPEND` Go version tracks upstream's `go.mod` `go` directive.