chore: enforce shellcheck across the repo

Establish shellcheck as a mandatory pre-commit quality gate and bring all 93
shell scripts to a clean state.

- tests/shellcheck.sh: wrapper that runs koalaman/shellcheck:stable via Docker
  (no native binary needed), skips vendored + upstream librenms-agent scripts.
- .shellcheckrc: documents intentional codebase-wide disables (dynamic source
  paths SC1090/SC1091, client-side ssh expansion SC2029).
- AGENTS.md: new Git Policy rule mandating clean shellcheck for every shell
  script before commit.

Fixes applied (real bugs + quality): missing quote in netinfra/gather-configs.sh
(caused cascading parse errors), unquoted expansions, declare-and-assign masking,
egrep -> grep -E, $FUNCNAME array indexing, unused variable removal, cd || exit.
Intentional patterns (sourced config, sysfs/ps diagnostics, ssh heredocs that
expand local config) get justified targeted disables.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

k8s/env.sh

@@ -1,4 +1,5 @@
 #!/usr/bin/bash
+# shellcheck disable=SC2034 # sourced config file; variables are consumed by scripts that source this
 # k8s/env.sh — shared config for all k8s scripts. Source this.
 #
 # All cluster communication goes over Tailscale IPs. No LAN IPs, ever.

k8s/install-cp.sh

@@ -35,6 +35,7 @@ echo "============================================"
 echo ""
 echo "--- [1/5] Installing bootstrap node: $CNODE1_NAME ($CNODE1_IP) ---"
 
+# shellcheck disable=SC2087 # heredoc intentionally expands local config (node IPs, k3s version) before sending to remote
 ssh "${SSH_OPTS[@]}" "${SSH_USER}@${CNODE1_IP}" "sudo -n bash -s" <<REMOTE_BOOT
 set -euo pipefail
 export INSTALL_K3S_VERSION="$K3S_VERSION"
@@ -103,6 +104,7 @@ for node_ip in "$CNODE2_IP" "$CNODE3_IP"; do
   echo ""
   echo "--- [4/5] Joining server: $node_name ($node_ip) ---"
 
+# shellcheck disable=SC2087 # heredoc intentionally expands local config before sending to remote
   ssh "${SSH_OPTS[@]}" "${SSH_USER}@${node_ip}" "sudo -n bash -s" <<REMOTE_JOIN
 set -euo pipefail
 export INSTALL_K3S_VERSION="$K3S_VERSION"

k8s/join-servers.sh

@@ -71,6 +71,7 @@ for node_ip in "$CNODE2_IP" "$CNODE3_IP"; do
   echo ""
   echo "--- [3/4] Joining server: $node_name ($node_ip) ---"
 
+# shellcheck disable=SC2087 # heredoc intentionally expands local config before sending to remote
   ssh "${SSH_OPTS[@]}" "${SSH_USER}@${node_ip}" "sudo -n bash -s" <<REMOTE_JOIN
 set -euo pipefail
 export INSTALL_K3S_VERSION="$K3S_VERSION"

k8s/verify.sh

@@ -99,7 +99,7 @@ echo "--- Workload isolation ---"
 USER_PODS=$(kubectl get pods -A --field-selector spec.nodeName="${CNODE1_NAME}" -o jsonpath='{.items[*].metadata.name}' 2>/dev/null | wc -w)
 # Subtract system pods
 SYSTEM_PODS=$(kubectl get pods -A --field-selector spec.nodeName="${CNODE1_NAME}" -l k8s-app --no-headers 2>/dev/null | wc -l)
-if [ "$USER_PODS" -le 10 ]; then ok "Only system pods on cnodes (expected)"; else fail "Unexpected pods on $CNODE1_NAME"; fi
+if [ "$((USER_PODS - SYSTEM_PODS))" -le 0 ]; then ok "Only system pods on cnodes (expected)"; else fail "Unexpected pods on $CNODE1_NAME"; fi
 
 echo ""
 echo "============================================"