Add shellcheck lint and bats tests

make lint runs shellcheck on every tracked bash script, make test runs
the bats suite in tests/, and make check runs both. The tests cover the
update orchestrator (hook isolation, failure reporting, pull and
free-space handling) and utils.sh (migrations, package install and
removal, services, initramfs build check), using stub commands so they
never touch the real system.

Fixes from the first lint run: 20-aur.sh stops if a cd fails rather
than building or deleting in the wrong directory, and
80-gnome-extensions.sh refuses to rm -rf with an empty path. The rest
are false positives, silenced in .shellcheckrc or per line.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

configure.d/10-core.sh

@@ -1,6 +1,9 @@
 #!/bin/bash
 
+# configure reads TITLE and DESCRIPTION
+# shellcheck disable=SC2034
 TITLE="Federated Computer Core"
+# shellcheck disable=SC2034
 DESCRIPTION="Superpanel, Nextcloud, email, files and Element"
 
 # Each Core is in cores/<domain>.conf, with what you entered last time, so
@@ -309,7 +312,7 @@ step() {
 # can't be reached.
 ask_password() {
   local tries
-  for tries in 1 2 3; do
+  for _ in 1 2 3; do
     read -rsp "Your Core password: " PASSWORD
     echo
     if [ -n "$1" ]; then nextcloud_app_password "$1"; else nextcloud_sign_in; fi
@@ -381,7 +384,7 @@ change_password() {
   local tries reached=1
   load_core "$1"
   STATUS=0
-  for tries in 1 2 3; do
+  for _ in 1 2 3; do
     read -rsp "Your new Core password: " PASSWORD
     echo
     nextcloud_sign_in

configure.d/15-tailscale.sh

@@ -1,6 +1,9 @@
 #!/bin/bash
 
+# configure reads TITLE and DESCRIPTION
+# shellcheck disable=SC2034
 TITLE="Tailscale"
+# shellcheck disable=SC2034
 DESCRIPTION="Join your Core's Tailscale network"
 
 CORE_CONF="$HOME/.config/coredesktop/core.conf"

configure.d/20-backup.sh

@@ -1,6 +1,9 @@
 #!/bin/bash
 
+# configure reads TITLE and DESCRIPTION
+# shellcheck disable=SC2034
 TITLE="Backup"
+# shellcheck disable=SC2034
 DESCRIPTION="Back up your home folder daily to your Nextcloud files"
 
 CORE_CONF="$HOME/.config/coredesktop/core.conf"
@@ -33,7 +36,7 @@ nextcloud_login() {
   local tries
   [ -n "$(backup_secret nextcloud "$WEBDAV")" ] \
     && rclone lsf --max-depth 1 ":webdav:" > /dev/null 2>&1 && return 0
-  for tries in 1 2 3; do
+  for _ in 1 2 3; do
     read -rsp "Your Core password: " PASSWORD
     echo
     nextcloud_app_password "CoreDesktop backup on $HOSTNAME"
@@ -161,7 +164,7 @@ run_configure() {
       echo "There's already a backup in $BACKUP_DIR in your Nextcloud files."
       read -rsp "Its passphrase: " pass
       echo
-      RESTIC_PASSWORD_COMMAND= RESTIC_PASSWORD="$pass" restic cat config > /dev/null \
+      RESTIC_PASSWORD_COMMAND='' RESTIC_PASSWORD="$pass" restic cat config > /dev/null \
         || { echo "restic couldn't open it with that passphrase."; return 1; }
       save_secret passphrase "$WEBDAV/$BACKUP_DIR" "$pass" || return 1
     fi

configure.d/30-claude.sh

@@ -1,6 +1,9 @@
 #!/bin/bash
 
+# configure reads TITLE and DESCRIPTION
+# shellcheck disable=SC2034
 TITLE="Claude Code"
+# shellcheck disable=SC2034
 DESCRIPTION="Sign in to Anthropic"
 
 is_installed() {

configure.d/31-opencode.sh

@@ -1,6 +1,9 @@
 #!/bin/bash
 
+# configure reads TITLE and DESCRIPTION
+# shellcheck disable=SC2034
 TITLE="opencode"
+# shellcheck disable=SC2034
 DESCRIPTION="Sign in to AI providers"
 
 is_installed() {

configure.d/32-hermes.sh

@@ -1,6 +1,9 @@
 #!/bin/bash
 
+# configure reads TITLE and DESCRIPTION
+# shellcheck disable=SC2034
 TITLE="Hermes Agent"
+# shellcheck disable=SC2034
 DESCRIPTION="Choose a model provider and tools"
 
 is_installed() {