fix: [nomad-step-0] S0.5 — Woodpecker CI validation for nomad/vault artifacts (#825)

Locks in static validation for every Nomad+Vault artifact before it can
merge. Four fail-closed steps in .woodpecker/nomad-validate.yml, gated
to PRs touching nomad/, lib/init/nomad/, or bin/disinto:

  1. nomad config validate nomad/server.hcl nomad/client.hcl
  2. vault operator diagnose -config=nomad/vault.hcl -skip=storage -skip=listener
  3. shellcheck --severity=warning lib/init/nomad/*.sh bin/disinto
  4. bats tests/disinto-init-nomad.bats — dispatcher smoke tests

bin/disinto picks up pre-existing SC2120 warnings on three passthrough
wrappers (generate_agent_docker, generate_caddyfile, generate_staging_index);
annotated with shellcheck disable=SC2120 so the new pipeline is clean
without narrowing the warning for future code.

Pinned image versions (hashicorp/nomad:1.9.5, hashicorp/vault:1.18.5)
match lib/init/nomad/install.sh — bump both or neither.

nomad/AGENTS.md documents the stack layout, how to add a jobspec in
Step 1, how CI validates it, and the two-place version pinning rule.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

bin/disinto

@@ -207,18 +207,21 @@ generate_compose() {
 
 # Generate docker/agents/ files if they don't already exist.
 # (Implementation in lib/generators.sh)
+# shellcheck disable=SC2120  # passthrough wrapper; forwards any future args to impl
 generate_agent_docker() {
   _generate_agent_docker_impl "$@"
 }
 
 # Generate docker/Caddyfile template for edge proxy.
 # (Implementation in lib/generators.sh)
+# shellcheck disable=SC2120  # passthrough wrapper; forwards any future args to impl
 generate_caddyfile() {
   _generate_caddyfile_impl "$@"
 }
 
 # Generate docker/index.html default page.
 # (Implementation in lib/generators.sh)
+# shellcheck disable=SC2120  # passthrough wrapper; forwards any future args to impl
 generate_staging_index() {
   _generate_staging_index_impl "$@"
 }