GRM-51: refactor: convert shell scripts and inline workflow scripts to Python

AGENTS.md

@@ -3,7 +3,8 @@
 ## Build & Test Commands
 
 ```bash
-make setup          # Create venv, install deps, set up hooks
+make setup          # Create venv, install deps, set up hooks, install CI tools
+make install-tools  # Install actionlint, git-cliff, act_runner to ~/.local/bin
 make lint-all       # ruff + pyright + bandit + ansible-lint + checkmake + actionlint
 make pytest-cov     # Unit tests with 100% coverage enforcement
 make test-unit      # Unit tests without coverage
@@ -15,6 +16,11 @@ make workflow-dryrun # Dry-run all workflows in Docker (act_runner exec --dryrun
 make workflow-check # workflow-lint + workflow-dryrun
 ```
 
+`make setup` automatically installs all development tools:
+- **Python deps** via `scripts/setup.py` (pip install -e .[dev], ansible-galaxy, pre-commit hooks)
+- **checkmake** via `scripts/install_checkmake.py` (Makefile linter)
+- **actionlint, git-cliff, act_runner** via `scripts/install_tools.py` (CI/CD tools to ~/.local/bin)
+
 ## Workflow Verification (Before Push)
 
 Workflow YAML files (`.gitea/workflows/*.yml`) are verified with two tools:
@@ -22,16 +28,15 @@ Workflow YAML files (`.gitea/workflows/*.yml`) are verified with two tools:
 1. **actionlint** — Static linter that catches syntax errors, invalid
    expressions, unknown keys, type mismatches, and shellcheck issues.
    Config: `.gitea/actionlint.yaml` (registers custom `docker` runner label).
-   Install: `bash <(curl -sL https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)`
+   Installed automatically by `make setup` via `scripts/install_tools.py`.
 
 2. **act_runner exec --dryrun** — Gitea's own runner in dry-run mode.
    Validates job dependencies, step ordering, and Docker image selection
-   without starting containers. Install from
-   [gitea/act_runner releases](https://gitea.com/gitea/act_runner/releases).
+   without starting containers. Installed automatically by `make setup`.
 
 Both run via `make workflow-check` and are part of `make lint-all`.
 The pre-commit hook runs actionlint automatically when workflow files change.
-The CI `quality` job installs actionlint and runs `make lint-all`.
+The CI `quality` job runs `make setup` (which installs all tools) then `make lint-all`.
 
 ## Architecture
 
@@ -220,7 +225,7 @@ types from accidentally skipping releases.
 **Workflow-only paths** (infrastructure → no release needed):
 - `.gitea/**` — Gitea Actions workflows
 - `scripts/ci/**` — CI/CD automation scripts
-- `scripts/setup.sh`, `scripts/molecule_all.sh`, `scripts/__init__.py` — Shell scripts and package init
+- `scripts/setup.py`, `scripts/molecule_all.py`, `scripts/install_tools.py`, `scripts/__init__.py` — Dev tooling and package init
 - `docs/**` — Documentation
 - `tests/**` — Test files
 - `AGENTS.md`, `README.md`, `CHANGELOG.md`, `TROUBLESHOOTING.md` — Project docs
@@ -236,8 +241,8 @@ types from accidentally skipping releases.
 - Any new file type not in the allowlist
 
 **Script directory structure:**
-- `scripts/` — Dev tools (run locally by developers): `check_test_speed.py`, `configure_repo.py`, `install_checkmake.py`, `setup.sh`, `molecule_all.sh`
-- `scripts/ci/` — CI/CD automation (run by workflows): `release.py`, `publish.py`, `auto_merge.py`, `classify_changes.py`, `doc_coverage.py`, `sync_wiki.py`, etc.
+- `scripts/` — Dev tools (run locally by developers): `check_test_speed.py`, `configure_repo.py`, `install_checkmake.py`, `install_tools.py`, `setup.py`, `molecule_all.py`
+- `scripts/ci/` — CI/CD automation (run by workflows): `release.py`, `publish.py`, `auto_merge.py`, `classify_changes.py`, `detect_release_commit.py`, `push_badges.py`, `doc_coverage.py`, `sync_wiki.py`, etc.
 
 **CI behavior based on classification:**
 - **Molecule tests**: Only run when `ansible/` or `.ansible-lint` files change