chore: enforce shellcheck across the repo

Establish shellcheck as a mandatory pre-commit quality gate and bring all 93
shell scripts to a clean state.

- tests/shellcheck.sh: wrapper that runs koalaman/shellcheck:stable via Docker
  (no native binary needed), skips vendored + upstream librenms-agent scripts.
- .shellcheckrc: documents intentional codebase-wide disables (dynamic source
  paths SC1090/SC1091, client-side ssh expansion SC2029).
- AGENTS.md: new Git Policy rule mandating clean shellcheck for every shell
  script before commit.

Fixes applied (real bugs + quality): missing quote in netinfra/gather-configs.sh
(caused cascading parse errors), unquoted expansions, declare-and-assign masking,
egrep -> grep -E, $FUNCNAME array indexing, unused variable removal, cd || exit.
Intentional patterns (sourced config, sysfs/ps diagnostics, ssh heredocs that
expand local config) get justified targeted disables.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

AGENTS.md

@@ -47,6 +47,17 @@ vendor/              Vendored KNELShellFramework
 2. **Atomic commits.** Each commit coherent on its own.
 3. **Conventional format**: `feat(scope): desc`, `fix(scope): desc`,
    `docs: desc`, `refactor(scope): desc`, `test(scope): desc`.
+4. **All shell scripts MUST pass `shellcheck` before commit.** No exceptions.
+   Run it via the wrapper:
+   ```bash
+   bash tests/shellcheck.sh                 # whole repo
+   bash tests/shellcheck.sh ups/*.sh        # specific files
+   ```
+   This invokes `koalaman/shellcheck:stable` through Docker (no native binary
+   needed). Fix every reported finding — including `info`-level — or add a
+   targeted `# shellcheck disable=SCxxxx  # <reason>` directive with a
+   justification. A script that emits any diagnostic is a protocol violation.
+   Non-bash scripts (PHP with `.sh` shebang `#!/usr/bin/php`, etc.) are exempt.
 
 ## Automatic Gardening Protocol