[LINT] Add shellcheck for shell scripts

[agentydragon]

Summary

• Add shellcheck pre-commit hook + .shellcheckrc config
• Fix quoting issues in build.sh, entrypoint.sh, bash-init.sh, run-ansible-lint.sh
• Add pkgs.shellcheck to devShell in flake.nix
• Low-value rules (style suggestions in debug/one-off scripts) disabled with TODO to tighten incrementally

Test plan

• shellcheck passes on all tracked .sh files
• pre-commit run shellcheck --all-files passes

https://claude.ai/code/session_01TVjKdv6UebLZt9FP7ZuAbt

[Copilot]

Pull request overview

Adds ShellCheck into the repo’s local tooling (Nix devShell + pre-commit) and fixes ShellCheck-triggered quoting issues in several shell scripts, with a repo-wide .shellcheckrc to suppress selected rules.

Changes:

• Add a local shellcheck pre-commit hook and a root .shellcheckrc configuration.
• Add pkgs.shellcheck to the Nix web-session toolchain.
• Fix unquoted variable expansions / command substitutions in multiple .sh scripts.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
nix/home/shell/bash-init.sh	Quotes command substitutions for LESS_TERMCAP_* env vars used by the custom man() wrapper.
flake.nix	Adds pkgs.shellcheck to the web-session tool bundle so pre-commit can run it via Nix.
cluster/k8s/agents/devbot/docker/desktop/entrypoint.sh	Quotes $RESOLUTION when passed to vncserver -geometry.
cluster/k8s/agents/devbot/docker/build.sh	Quotes Docker tag variables in docker build/docker push.
.shellcheckrc	Introduces centralized ShellCheck rule suppressions for the repo.
.pre-commit-config.yaml	Adds a local shellcheck hook (system-provided, via Nix devShell/web-session).
.github/scripts/run-ansible-lint.sh	Documents intentional word-splitting and suppresses SC2086 for the lint invocation.

[Copilot]

Disabling SC2148 globally can cause ShellCheck to fall back to its default shell for files without a shebang, which can mis-lint (or fail on) bash-specific sourced snippets. Since the repo has sourced bash scripts without shebangs (e.g. nix/home/shell/bash-init.sh uses local), consider either adding # shellcheck shell=bash (or a shebang) to those snippets, or setting an explicit default shell in this config, instead of suppressing SC2148 everywhere.

Suggested change

	# SC2148: Tips depend on target shell (missing shebang).
	# Many .sh files are sourced snippets (profile.d, shell init).
	disable=SC2148
	# Default shell: many sourced snippets are bash (no shebang).
	# This avoids mis-linting bash-specific code as /bin/sh.
	shell=bash