refactor(ci): workflows nested cluster

[universal-itengineer]

Description

Refactors the nested-cluster E2E CI workflows and supporting automation.

This PR replaces large inline workflow shell blocks with versioned scripts under .github/scripts/bash/e2e, adds reusable composite actions for common setup, registry login, kubeconfig, run ID, and encrypted artifact handling, and splits the previous monolithic E2E workflows into dedicated nightly and release-oriented reusable pipelines.

It also adds lint gates for GitHub Actions and shell scripts, moves repeated E2E CI logic into task/script entrypoints, and unifies static cluster values rendering through a shared test/dvp-static-cluster/values.yaml.tmpl plus .github/scripts/bash/e2e/render-dvp-static-values.sh. Nightly and release flows now pass runtime differences through environment/input values such as ENABLED_MODULES and cluster_config_additional_disk_size.

Why do we need it, and what problem does it solve?

The old nested-cluster E2E workflows mixed orchestration with long inline shell logic. That made changes difficult to review, duplicated release and nightly behavior, and left important CI code paths without direct lint coverage.

Moving operational logic into tracked scripts and composite actions makes the pipelines easier to maintain and reuse. The shared values template also removes drift between nightly and release cluster configuration while keeping release-specific settings explicit through workflow inputs.

What is the expected result?

Nested-cluster nightly and release E2E jobs continue to provision prerequisites, render static cluster values, configure storage and virtualization, run tests, collect encrypted artifacts, and clean up resources through the refactored workflows.

Validation for these changes is available with:

• task lint:shellcheck
• task lint:actionlint
• task e2e:e2e:ci from the repository root
• task e2e:ci inside test/e2e

Checklist

• The code is covered by unit tests. Not applicable: this is CI workflow and scripting refactoring.
• e2e tests passed.
• Documentation updated according to the changes. Composite action README files were added.
• Changes were tested in the Kubernetes cluster manually.

Changelog entries

section: ci
type: chore
summary: Refactor nested-cluster E2E workflows into reusable pipelines, scripts, and composite actions.
impact_level: low

[nevermarine]

need to test this

[universal-itengineer]

The masking + login is correct by GitHub's docs:

• The decoded username/password are freshly derived strings, so they aren't auto-masked — the explicit ::add-mask:: (lines 24-25) is required and is placed before the only command that uses them (docker login).
• --password-stdin keeps the password out of the process args.
• Steps run as bash --noprofile --norc -eo pipefail, so a broken base64 / missing auth will fail the step.

Masking with ::add-mask:: (manually masking values derived at runtime, like the decoded username/password):
- https://docs.github.com/en/actions/reference/workflow-commands-for-github-actions#masking-a-value-in-a-log
Note that auto-masking applies only to registered secrets: https://docs.github.com/en/actions/security-for-github-actions/security-guides/using-secrets-in-github-actions#about-secrets

Default bash shell flags -eo pipefail (and --noprofile --norc):
- https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idstepsshell (see the "bash" row in the default-shell table / exit-code handling)