chore: enforce shellcheck across the repo

Establish shellcheck as a mandatory pre-commit quality gate and bring all 93
shell scripts to a clean state.

- tests/shellcheck.sh: wrapper that runs koalaman/shellcheck:stable via Docker
  (no native binary needed), skips vendored + upstream librenms-agent scripts.
- .shellcheckrc: documents intentional codebase-wide disables (dynamic source
  paths SC1090/SC1091, client-side ssh expansion SC2029).
- AGENTS.md: new Git Policy rule mandating clean shellcheck for every shell
  script before commit.

Fixes applied (real bugs + quality): missing quote in netinfra/gather-configs.sh
(caused cascading parse errors), unquoted expansions, declare-and-assign masking,
egrep -> grep -E, $FUNCNAME array indexing, unused variable removal, cd || exit.
Intentional patterns (sourced config, sysfs/ps diagnostics, ssh heredocs that
expand local config) get justified targeted disables.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

perf/scripts/lacp-retrans-cause.sh

@@ -41,6 +41,7 @@ trap 'rm -rf "$TMP"' EXIT
 # plus all error-like counters. Falls back gracefully if a counter doesn't
 # exist (different NIC drivers expose different names).
 nic_snapshot() {
+    # shellcheck disable=SC2013 # interface names contain no spaces; word-splitting is safe here
     for s in $(awk '/^Slave Interface:/{print $3}' "/proc/net/bonding/$BOND"); do
         [ -n "$s" ] || continue
         echo "[$s]"
@@ -144,9 +145,10 @@ echo "Bond: $BOND"
 echo ""
 echo "--- bond0 hash + driver ---"
 grep -E "Bonding Mode|Transmit Hash|Number of ports|Partner Mac" /proc/net/bonding/$BOND
+# shellcheck disable=SC2013 # interface names contain no spaces; word-splitting is safe here
 for s in $(awk '/^Slave Interface:/{print $3}' /proc/net/bonding/$BOND); do
     drv=$(ethtool -i "$s" 2>/dev/null | awk -F: '/^driver:/{print $2}' | sed 's/^ *//')
-    speed=$(cat /sys/class/net/$s/speed 2>/dev/null)
+    speed=$(cat "/sys/class/net/$s/speed" 2>/dev/null)
     ring=$(ethtool -g "$s" 2>/dev/null | awk '/RX:/{print $2; exit}')
     printf "  %-8s driver=%-20s speed=%-6s current RX ring=%s\n" "$s" "$drv" "$speed" "$ring"
 done