Add a blocking `lint` CI stage (runs first, on a lightweight Alpine
image) plus a core.hooksPath pre-commit hook, with scripts/lint.sh as
the shared runner for CI, the hook, and manual use. Checks are
configured in .shellcheckrc and formatting in .editorconfig.
bootstrap.sh installs shellcheck + shfmt per-OS and enables the
pre-commit hook.
The hook is a convenience (bypassable with --no-verify); the CI
`lint-scripts` job enforces formatting. SC2086/SC2046 are
disabled for now. SC2002 is disabled too, since
shellcheck made it opt-in as of 0.11.0 while older versions (e.g.
Alpine's in CI) still enable it by default.
