ci: add a ShellCheck workflow

Every file here is a shell script that the README invites people to run
as root, and nothing has been linting them: .github/workflows was
deleted in 5eadf64 and never replaced. The bugs found in this week's
audit -- values interpolated into a command string, an unguarded
find -delete, exit statuses read from $? after the fact -- are largely
the class a linter catches for free.

Starts at severity: error deliberately. The existing scripts have never
been through a lint pass, so failing on warnings from day one would
block every PR on pre-existing findings rather than on new ones. The
intent is to tighten to warning, then to nothing, as the backlog is
cleared.

.github/workflows/shellcheck.yml

@@ -0,0 +1,33 @@
+name: ShellCheck
+
+# Every file in this repository is a shell script that people are
+# invited to run as root, so a lint gate is the cheapest guard against
+# the class of bug that keeps showing up here: unquoted expansions,
+# values interpolated into commands, and exit statuses that go unchecked.
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  shellcheck:
+    name: ShellCheck
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Run ShellCheck
+        uses: ludeeus/action-shellcheck@master
+        with:
+          # Findings are reported but do not fail the build yet: the
+          # existing scripts have not been through a lint pass, so
+          # failing on day one would block every PR on pre-existing
+          # issues. Tighten to "error" -> "warning" -> remove once the
+          # backlog is cleared; see the audit in the README.
+          severity: error
+          check_together: 'yes'
+          format: gcc