ci: Rewrite lint task Bash snippet to Python

The Bash snippet was shorter, but relying on implicit word splitting
(see the shellcheck SC2086 warning).

For example, the DOCKER_BUILD_CACHE_ARG shlex.split is now done
identical to how ci/test/02_run_container.py does it.

Moreover, the Python will hopefully be easier to modify in the future,
as the dev notes recommend Python over Bash.

.github/workflows/ci.yml

@@ -599,11 +599,37 @@ jobs:
           cache-provider: ${{ needs.runners.outputs.provider }}
 
       - name: CI script
+        shell: python
         run: |
-          set -o xtrace
-          docker buildx build -t "$CONTAINER_NAME" $DOCKER_BUILD_CACHE_ARG --file "./ci/lint_imagefile" .
-          CIRRUS_PR_FLAG=""
-          if [ "${{ github.event_name }}" = "pull_request" ]; then
-            CIRRUS_PR_FLAG="-e CIRRUS_PR=1"
-          fi
-          docker run --rm $CIRRUS_PR_FLAG -v "$(pwd)":/bitcoin "$CONTAINER_NAME"
+          import os, shlex, subprocess, sys
+
+          def run(cmd, **kwargs):
+              print("+ " + shlex.join(cmd), flush=True)
+              kwargs.setdefault("check", True)
+              try:
+                  return subprocess.run(cmd, **kwargs)
+              except Exception as e:
+                  sys.exit(e)
+
+          CONTAINER_NAME = os.environ["CONTAINER_NAME"]
+
+          build_cmd = [
+              "docker", "buildx", "build",
+              f"--tag={CONTAINER_NAME}",
+              *shlex.split(os.getenv("DOCKER_BUILD_CACHE_ARG", "")),
+              "--file=./ci/lint_imagefile",
+              "."
+          ]
+
+          run(build_cmd)
+
+          CIRRUS_PR_FLAG = []
+          if '${{ github.event_name }}' == "pull_request":
+              CIRRUS_PR_FLAG = ["-e", "CIRRUS_PR=1"]
+
+          run([
+              "docker", "run", "--rm",
+              *CIRRUS_PR_FLAG,
+              f"--volume={os.getcwd()}:/bitcoin",
+              CONTAINER_NAME,
+          ])