Add shellcheck to CI (refs #1)

[dolph]

Summary

• Adds a shellcheck job to .github/workflows/go.yml that runs on every PR (and push to main).
• The job discovers shell scripts dynamically rather than hard-coding paths — newly added or renamed scripts get linted automatically without further workflow changes, regardless of which directory they live in.
• Fixes the one finding shellcheck reports today: SC2046 in build.sh, an unquoted command substitution nested inside git rev-parse --short. Quoting the inner $(git rev-list -1 HEAD) resolves the warning so the new job is green from the start.

Refs #1.

Discovery approach

shellcheck has no built-in recursive / directory-scan option (shellcheck --help confirms FILES... is a hard requirement), so discovery is done externally. The step uses git ls-files, which has two nice properties:

1. It only enumerates tracked files — no scanning into .git/, vendored deps, or local untracked artifacts.
2. New or renamed scripts appear in git ls-files output on the PR that introduces them, so they get linted on that same PR with no manual update to the workflow.

Two predicates feed into the script list, then deduped via sort -u:

• Any file matching *.sh / *.bash / *.ksh / *.zsh.
• Any file whose first line matches ^#!.*sh([[:space:]]|$) — covers #!/bin/sh, #!/bin/bash, #!/usr/bin/env bash, #!/bin/dash -x, #!/bin/zsh, etc., catching scripts without a conventional extension.

Tested locally on this branch: discovers build.sh and install.sh, shellcheck exits 0.

Scope note

This is the belt-and-suspenders half of the test plan posted on #1, not the load-bearing test. shellcheck doesn't model curl's flag semantics, so it does not catch the specific curl -L -o <URL> bug from that issue. A behavioral test — running the download step against a local HTTP fixture in CI and asserting that a ussher binary file actually lands in cwd — is still needed to cover #1 directly. That belongs in a separate PR.

What this PR does buy us: cheap, automatic coverage for the broader class of shell-script bugs (unquoted expansions, [[ vs [, dead code, missing -- separators, etc.) for every shell script in the repo, now and in the future.

Test plan

• Discovery snippet picks up install.sh and build.sh locally.
• shellcheck exits 0 against the discovered set.
• ./build.sh still runs end-to-end and GIT_COMMIT is populated correctly after the SC2046 fix (tests pass, --version prints expected commit SHA).
• CI run on the PR shows the new shellcheck job passing alongside the existing build job.
• Future regression test: a follow-up PR that adds a script anywhere under the repo (with or without a .sh extension, as long as it has a shell shebang) is automatically linted with no further workflow changes.

https://claude.ai/code/session_013HnepY8MhhxrJJjE5ysW47

[dolph]

We can safely assume all shell files in this repo are .sh