Add shellcheck lint and bats tests

make lint runs shellcheck on every tracked bash script, make test runs
the bats suite in tests/, and make check runs both. The tests cover the
update orchestrator (hook isolation, failure reporting, pull and
free-space handling) and utils.sh (migrations, package install and
removal, services, initramfs build check), using stub commands so they
never touch the real system.

Fixes from the first lint run: 20-aur.sh stops if a cd fails rather
than building or deleting in the wrong directory, and
80-gnome-extensions.sh refuses to rm -rf with an empty path. The rest
are false positives, silenced in .shellcheckrc or per line.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Makefile

@@ -0,0 +1,14 @@
+# Every tracked file (not symlink) that starts with a bash or sh shebang (\043 is "#", which
+# make would otherwise read as the start of a comment)
+SCRIPTS := $(shell git ls-files -s | awk '$$1 != 120000 { print $$4 }' | xargs awk 'FNR == 1 && /^#!.*[\/ ](ba)?sh/ { print FILENAME }')
+
+.PHONY: check lint test
+
+check: lint test
+
+# Errors and warnings only, for now; drop --severity to see style notes too
+lint:
+	shellcheck --severity=warning $(SCRIPTS)
+
+test:
+	bats tests