Add shellcheck lint and bats tests

make lint runs shellcheck on every tracked bash script, make test runs
the bats suite in tests/, and make check runs both. The tests cover the
update orchestrator (hook isolation, failure reporting, pull and
free-space handling) and utils.sh (migrations, package install and
removal, services, initramfs build check), using stub commands so they
never touch the real system.

Fixes from the first lint run: 20-aur.sh stops if a cd fails rather
than building or deleting in the wrong directory, and
80-gnome-extensions.sh refuses to rm -rf with an empty path. The rest
are false positives, silenced in .shellcheckrc or per line.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

system/backup

@@ -27,7 +27,7 @@ source "$COREDESKTOP/system/backup-env.sh" || exit 1
 [ -n "$RESTIC_PASSWORD_COMMAND" ] || fail "The backup's passphrase isn't in your keyring. Run: configure backup"
 
 # Run at login, perhaps before the network is up; give it a few minutes
-for try in {1..10}; do
+for _ in {1..10}; do
   curl -sf --max-time 10 -o /dev/null "${BACKUP_WEBDAV%%/remote.php/*}/status.php" && break
   sleep 30
 done