Add shellcheck lint and bats tests

make lint runs shellcheck on every tracked bash script, make test runs
the bats suite in tests/, and make check runs both. The tests cover the
update orchestrator (hook isolation, failure reporting, pull and
free-space handling) and utils.sh (migrations, package install and
removal, services, initramfs build check), using stub commands so they
never touch the real system.

Fixes from the first lint run: 20-aur.sh stops if a cd fails rather
than building or deleting in the wrong directory, and
80-gnome-extensions.sh refuses to rm -rf with an empty path. The rest
are false positives, silenced in .shellcheckrc or per line.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

updates.d/20-aur.sh

@@ -10,14 +10,14 @@ YAY_FLAGS="--noconfirm --answerdiff=None --answeredit=None --answerclean=None"
 if ! yay --version &>/dev/null; then
     echo "yay is broken (likely a libalpm bump). Rebuilding yay..."
     sudo pacman -R --noconfirm yay
-    cd /tmp
+    cd /tmp || exit 1
     rm -rf yay
     git clone https://aur.archlinux.org/yay.git
-    cd yay
+    cd yay || exit 1
     makepkg -si --noconfirm
     cd ..
     rm -rf yay
-    cd
+    cd || exit 1
 fi
 
 yay -Sua $YAY_FLAGS

updates.d/80-gnome-extensions.sh

@@ -50,7 +50,7 @@ reinstall_incompatible_extensions() {
       rm -rf "$backup"
     else
       echo "Reinstall of $uuid failed; restoring the previous version."
-      rm -rf "$ext_root/$uuid"
+      rm -rf "${ext_root:?}/${uuid:?}"
       mv "$backup/$uuid" "$ext_root/$uuid"
       rmdir "$backup"
     fi