ironfox-oss/IronFox!162
Add a blocking `lint` CI stage (runs first, on a lightweight Alpine
image) plus a core.hooksPath pre-commit hook, with scripts/lint.sh as
the shared runner for CI, the hook, and manual use. Checks are
configured in .shellcheckrc and formatting in .editorconfig.
Reformat all scripts with shfmt (2-space indent, switch-case indent,
space redirects) via .editorconfig, so a bare `shfmt` is consistent
everywhere. bootstrap.sh installs shellcheck + shfmt per-OS and
enables the pre-commit hook.
The hook is a convenience (bypassable with --no-verify); the CI
`lint-scripts` job is the enforcement gate. SC2086/SC2046 are
disabled for now as tracked follow-up.
MR-author: Akash Yadav <itsaky01@gmail.com>
Co-authored-by: Akash Yadav <contact@itsaky.com>
Approved-by: celenity <celenity@celenity.dev>
Merged-by: celenity <celenity@celenity.dev>
This should improve security (by ensuring we always specify the full paths to executables, and preventing use of unintended/undesired system executables), control (by allowing users to specify where these executables should be located), and consistency/reproducability
Signed-off-by: celenity <celenity@celenity.dev>
