chore: add ShellCheck lint script (#6)

[montoyaedu]

What

Introduces npm run lint (ShellCheck) — blocker 1 of 2 for unblocking git push. The .husky/pre-push hook's Lint stage ran npm run lint, which didn't exist; now it does and exits 0.

Closes #6.

Changes

New lint script (package.json) — runs shellcheck over the project's own shell sources: easy, configure-local-devenv, commands/*.sh, the easyhome/ shell scripts, and .husky/pre-push.

Real errors fixed:

• easy — $@ passed unquoted at 4 dispatcher call sites (ruby, python, __easy_command_*, top-level easy). SC2068 — unquoted $@ re-splits arguments. Now "$@".
• commands/proxy.sh — debug() was $(>&2 echo $@): the $() captures stdout (redirected away → empty) and then tries to execute that empty string. Replaced with >&2 echo "$@". Fixes SC2328/SC2068/SC2091/SC2327/SC2116.

Pre-existing warnings baselined — per the agreed scoped approach, the remaining ~55 findings (mostly SC2086 unquoted vars, SC2155 declare+assign) are suppressed with documented file-level # shellcheck disable= directives, each pointing to the cleanup issue. Burn-down tracked in #8.

Docs — CLAUDE.md §3 documents the shellcheck prerequisite and npm run lint.

Scope deviation from the issue

Issue #6 listed bin/*.sh as lint targets. Those are metaswarm-vendored third-party scripts (overwritten on plugin update) — adding disable directives to them would be inappropriate, so they're excluded from the lint set. .husky/pre-push is included (currently clean).

Test plan

• npm run lint exits 0
• bash -n syntax check passes on all 6 edited shell files
• package.json is valid JSON
• Manual smoke test (CLAUDE.md §6) — recommended before merge, since there's no automated suite yet (that's Add bats test harness + kcov coverage tooling (unblocks pre-push hook — coverage stage) #7)

Notes

• The pre-push coverage stage (kcov coverage bats test/) still fails — that's blocker 2, fixed by Add bats test harness + kcov coverage tooling (unblocks pre-push hook — coverage stage) #7. This branch was pushed with git push --no-verify; once Add bats test harness + kcov coverage tooling (unblocks pre-push hook — coverage stage) #7 merges, pushes work without it.

🤖 Generated with Claude Code

[montoyaedu]

Smoke test — dispatcher ✓

Ran with EASY_LETSENCRYPT_DIR/EASY_DOMAINS_DIR set, repo on PATH:

Command	Result
easy --version	2.0.0, exit 0
easy (no args)	usage shown
easy bogus-cmd	usage shown
easy proxy	routes to commands/proxy.sh → proxy usage

The "$@" quoting fix in the dispatcher routes arguments correctly. bash -n passed on all 6 edited shell files.

Note: CI does not run on this PR — .github/workflows/ci.yml (metaswarm-scaffolded) triggers on branch main, but this repo's default branch is master. Tracked separately from #6.