Add ShellCheck linting to CI

[tomgrv]

Problem

shellcheck is one of the utilities common-utils can install for consumers (see src/common-utils/devcontainer-feature.json default utils option), but it is never run against this repo's own shell scripts. There are roughly 300 shell scripts across src/*/install*.sh and the _zz_*.sh helper library, none of which are linted in CI.

This matters because several recurring fixes in git history are exactly the class of bug ShellCheck catches early (unquoted variables, missing set -e, platform-specific command assumptions), e.g.:

• 5818e42 fix(githooks): use sudo for chmod to ensure proper permissions
• 9783e74 fix(common-utils): update package file handling for accuracy

Proposal

• Add a CI workflow (or a job inside an existing one) that runs shellcheck over all *.sh files under src/**, plus root-level install.sh, install-deps.sh, install-feat.sh.
• Start in warn-only mode if there's a backlog of existing violations, then tighten to fail-on-error once the backlog is triaged.

Where this lives / sync note

This should run at the monorepo level (root .github/workflows/) since it needs visibility across all src/<feature> directories at once — it does not need to be duplicated into each split repo, but the scripts it lints (_zz_*.sh in src/common-utils, and each feature's install*.sh) do flow into the split repos via split-monorepo.yml, so fixes found here should be made directly in the relevant src/<feature> source, not patched downstream.

Acceptance criteria

• CI workflow runs shellcheck against all repo shell scripts on PR.
• Existing violations are either fixed or explicitly suppressed with a documented reason.
• New violations fail CI.