ci: check the setting paths shipped scripts hand to cli (#146)

* ci: check the setting paths shipped scripts hand to cli

`cli -s` cannot fail. yaml-cli stores whatever dotted path it is given,
creating intermediate mappings as it goes, and exits 0; majestic then silently
ignores a key it does not recognise. So a typo in a setting path applies
nothing and reports nothing, from the moment it is written to the end of the
device's life.

t40_lite_movols-mo-805p has been shipping six of them:

    cli -s .video0.bitrate: 4000
    cli -s .video0.rcMode: avbr

The path is `.video0.bitrate:`, not `.video0.bitrate`. Bitrate, rate-control
mode, profile, GOP size, GOP mode and OSD size have never applied on that
camera. The trailing colons are dropped here, including the one on the
commented-out `.onvif.enabled:`, which was a trap for whoever uncommented it.

The linter checks shape and nothing else. Whether a well-formed key is one a
given majestic build actually declares can only be answered by the running
binary -- it varies by vendor and by flavour -- while shape is decidable from
the tree, costs nothing, and is the whole of the class that shipped. A path
built at runtime is skipped rather than guessed at: uvc-gadget-setup reads
`cli -g ".$1"`, which is fine and unknowable here.

It carries a floor check for the same reason lint-workflow-shell.py does. A
matcher that quietly stops matching finds no bad paths, which looks exactly
like a clean tree -- so finding no cli invocation at all is itself a failure.

80 scripts scanned, 610 invocations, 6 bad paths, all in the one device.

* ci: recheck the merged result when the cli linter itself changes

lint.yml's push trigger names the checkers it guards one by one, and the new
one was not on the list -- so a master push touching only
.github/scripts/lint-cli-paths.py would have skipped the very job that exists
because #121 shipped a broken merged result nothing re-checked.

Same reasoning as the lint-workflow-shell.py entry beside it, and the same
cost: seconds, no runners.

.github/workflows/lint.yml

@@ -16,6 +16,7 @@ on:
     paths:
       - '.github/workflows/**'
       - '.github/scripts/lint-workflow-shell.py'
+      - '.github/scripts/lint-cli-paths.py'
   workflow_dispatch:
 
 # Reads the tree and reports; writes nothing. Declared rather than inherited so
@@ -72,3 +73,12 @@ jobs:
       # by commits in that repository and not by anything in a PR here.
       - name: Check the drift checker still describes the tree
         run: python3 .github/scripts/check-firmware-drift.py --self-test
+      # `cli -s` cannot fail: yaml-cli stores whatever dotted path it is given,
+      # and majestic silently ignores a key it does not recognise. So a typo in
+      # a setting path applies nothing and says nothing, for the life of the
+      # device. t40_lite_movols-mo-805p shipped six of them behind a trailing
+      # colon. Same shape as the checks above -- no runners, no matrix, seconds.
+      - name: Check the cli path linter still catches what it should
+        run: python3 .github/scripts/lint-cli-paths.py --self-test
+      - name: Check every shipped cli setting path
+        run: python3 .github/scripts/lint-cli-paths.py