chore: apply round-7 review nits

- _extract_token.py: narrow `except Exception` to
  `except (json.JSONDecodeError, ValueError)`. Prevents swallowing
  KeyboardInterrupt in edge cases and documents intent clearly.
- ci.yml shellcheck job: switch to ludeeus/action-shellcheck@master
  (caches shellcheck binary across runs; saves the apt-get install).

Both changes verified locally: YAML parses, extract script still
extracts valid tokens and prints the stderr warning on malformed JSON.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -170,9 +170,11 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Run shellcheck on tests/e2e/*.sh
-        run: |
-          sudo apt-get update -qq && sudo apt-get install -y -qq shellcheck
-          shellcheck --severity=warning tests/e2e/*.sh
+        uses: ludeeus/action-shellcheck@master
+        env:
+          SHELLCHECK_OPTS: --severity=warning
+        with:
+          scandir: tests/e2e
 
   python-lint:
     name: Python Lint & Test

tests/e2e/_extract_token.py

@@ -13,7 +13,7 @@ import sys
 
 try:
     data = json.load(sys.stdin)
-except Exception as e:
+except (json.JSONDecodeError, ValueError) as e:
     sys.stderr.write(f"e2e_extract_token: invalid JSON response ({e})\n")
     print("")
     raise SystemExit(0)