fix: keep touch copy controls visible and pass POSIX lint

.github/workflows/check.yml

@@ -10,14 +10,22 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '22'
           cache: npm
       - run: npm ci
       - name: Install shell test interpreters
-        run: sudo apt-get update && sudo apt-get install -y busybox shellcheck
+        run: |
+          if ! command -v busybox >/dev/null || ! command -v shellcheck >/dev/null; then
+            sudo apt-get update
+            sudo apt-get install -y busybox-static shellcheck
+          fi
+          busybox sh -c 'echo "BusyBox shell ready"'
+          shellcheck --version
       - name: Run unit, shell, and real-browser tests
         run: npm test
         env:
@@ -29,7 +37,7 @@ jobs:
         run: npx wrangler deploy --dry-run --config cf-worker/wrangler.toml --outdir /tmp/worker-dry-run
       - name: Upload browser evidence
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: browser-evidence
           path: /tmp/quickly-browser-artifacts