ci: add shellcheck linter (#37682)

- Adds `make lint-shell`. uses local `shellcheck` if its version
matches, otherwise runs the pinned image via docker or podman
- `.shellcheckrc` disables the most annoying rules
- Fixes findings across existing scripts

Fixes: #37648
Signed-off-by: silverwind <me@silverwind.io>
Co-authored-by: Claude (Opus 4.7) <noreply@anthropic.com>
Co-authored-by: TheFox0x7 <thefox0x7@gmail.com>
Co-authored-by: Nicolas <bircni@icloud.com>

.github/workflows/pull-compliance.yml

@@ -54,6 +54,9 @@ jobs:
       - if: needs.files-changed.outputs.actions == 'true'
         run: make lint-actions
 
+      - if: needs.files-changed.outputs.shell == 'true'
+        run: make lint-shell
+
   checks-backend:
     if: needs.files-changed.outputs.backend == 'true' || needs.files-changed.outputs.actions == 'true'
     needs: files-changed