chore: enforce shellcheck across the repo

Establish shellcheck as a mandatory pre-commit quality gate and bring all 93
shell scripts to a clean state.

- tests/shellcheck.sh: wrapper that runs koalaman/shellcheck:stable via Docker
  (no native binary needed), skips vendored + upstream librenms-agent scripts.
- .shellcheckrc: documents intentional codebase-wide disables (dynamic source
  paths SC1090/SC1091, client-side ssh expansion SC2029).
- AGENTS.md: new Git Policy rule mandating clean shellcheck for every shell
  script before commit.

Fixes applied (real bugs + quality): missing quote in netinfra/gather-configs.sh
(caused cascading parse errors), unquoted expansions, declare-and-assign masking,
egrep -> grep -E, $FUNCNAME array indexing, unused variable removal, cd || exit.
Intentional patterns (sourced config, sysfs/ps diagnostics, ssh heredocs that
expand local config) get justified targeted disables.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

console/discover.sh

@@ -1,4 +1,5 @@
 #!/usr/bin/bash
+# shellcheck disable=SC2010,SC2012 # diagnostic script; ls|grep/ls -la on sysfs & log dirs is intentional for human-readable output
 #
 # console/discover.sh — READ-ONLY discovery of console setup on pfv-tsys4
 #

console/generate-config.sh

@@ -33,8 +33,6 @@ CONMAN_LOGDIR="${CONMAN_LOGDIR:-/var/log/conman}"
 UDEV_RULES="/etc/udev/rules.d/99-console-ports.rules"
 SER2NET_CONF="/etc/ser2net.yaml"
 CONMAN_CONF="/etc/conman.conf"
-CONMAN_CONSOLES="/etc/conman/console-consoles.conf"
-CONSOLE_DEV_DIR="/dev/console"
 
 echo "============================================"
 echo "  Console Config Generator"
@@ -120,9 +118,11 @@ for entry in "${ENTRIES[@]}"; do
   # Build the full ID_PATH match. The mapping stores a substring like "usb-0:1.5.4.4"
   # The actual ID_PATH is like "pci-0000:00:1a.0-usb-0:1.5.4.4:1.0"
   # We match on the substring to be portable across PCI bus changes.
-  echo "" >> "$UDEV_RULES"
-  echo "# $name (TCP $tcp_port): $comment" >> "$UDEV_RULES"
-  echo "SUBSYSTEM==\"tty\", ENV{ID_PATH}==\"*$id_path*\", SYMLINK+=\"console/$name\"" >> "$UDEV_RULES"
+  {
+    echo ""
+    echo "# $name (TCP $tcp_port): $comment"
+    echo "SUBSYSTEM==\"tty\", ENV{ID_PATH}==\"*$id_path*\", SYMLINK+=\"console/$name\""
+  } >> "$UDEV_RULES"
 done
 
 echo "  Written: $UDEV_RULES"
@@ -148,13 +148,13 @@ fi
   echo "#"
   echo "# All ports use telnet(rfc2217) accepter so conman and telnet clients"
   echo "# negotiate proper telnet binary mode — this prevents CR stripping"
-  echo "# and stair-stepping on devices that send \\n\\r (LF+CR) line endings."
+  printf '%s\n' "# and stair-stepping on devices that send \\n\\r (LF+CR) line endings."
   echo "# Ports bound to Tailscale IP ($TS_IP) for secure remote access."
   echo "#"
   echo "# Direct telnet:  telnet $TS_IP 2001"
   echo "# Via conman:     conman -f <name>"
   echo ""
-  echo "define: &banner \\r\\nPFV console port \\p device \\d [\\B]\\r\\n\\r\\n"
+  printf '%s\n' "define: &banner \\r\\nPFV console port \\p device \\d [\\B]\\r\\n\\r\\n"
   echo ""
 
   for entry in "${ENTRIES[@]}"; do

console/setup.sh

@@ -1,4 +1,5 @@
 #!/usr/bin/bash
+# shellcheck disable=SC2010 # diagnostic; ls|grep on /dev listing is intentional
 #
 # console/setup.sh — deploy console management on pfv-tsys4
 #
@@ -19,10 +20,6 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-UDEV_RULES="/etc/udev/rules.d/99-console-ports.rules"
-SER2NET_CONF="/etc/ser2net.yaml"
-CONMAN_CONSOLES="/etc/conman/console-consoles.conf"
-CONSOLE_DEV_DIR="/dev/consoles"
 
 echo "============================================"
 echo "  Console Management Setup"
@@ -100,7 +97,7 @@ if [ ! -d /dev/consoles ] || [ -z "$(ls /dev/consoles/ 2>/dev/null)" ]; then
     line="${line%%#*}"
     line="$(echo "$line" | xargs)"
     [ -z "$line" ] && continue
-    IFS='|' read -r tcp_port name id_path baud comment <<< "$line"
+    IFS='|' read -r _ name id_path _ _ <<< "$line"
     # Find the ttyUSB whose ID_PATH contains the mapping's id_path substring
     for tty in /dev/ttyUSB*; do
       [ -e "$tty" ] || continue
@@ -124,7 +121,7 @@ while IFS= read -r line; do
   line="${line%%#*}"
   line="$(echo "$line" | xargs)"
   [ -z "$line" ] && continue
-  IFS='|' read -r tcp_port name id_path baud comment <<< "$line"
+  IFS='|' read -r _ name id_path _ _ <<< "$line"
   if [ -e "/dev/consoles/$name" ]; then
     TARGET=$(readlink -f "/dev/consoles/$name")
     echo "    [OK] /dev/consoles/$name -> $TARGET"

console/validate-conman.sh

@@ -1,4 +1,5 @@
 #!/usr/bin/bash
+# shellcheck disable=SC2012,SC2001 # diagnostic script; ls -la listings and sed line-prefixing are intentional
 #
 # console/validate-conman.sh — verify conman can actually reach devices via
 # ser2net TCP ports and is capturing log output to files.