chore: enforce shellcheck across the repo

Establish shellcheck as a mandatory pre-commit quality gate and bring all 93
shell scripts to a clean state.

- tests/shellcheck.sh: wrapper that runs koalaman/shellcheck:stable via Docker
  (no native binary needed), skips vendored + upstream librenms-agent scripts.
- .shellcheckrc: documents intentional codebase-wide disables (dynamic source
  paths SC1090/SC1091, client-side ssh expansion SC2029).
- AGENTS.md: new Git Policy rule mandating clean shellcheck for every shell
  script before commit.

Fixes applied (real bugs + quality): missing quote in netinfra/gather-configs.sh
(caused cascading parse errors), unquoted expansions, declare-and-assign masking,
egrep -> grep -E, $FUNCNAME array indexing, unused variable removal, cd || exit.
Intentional patterns (sourced config, sysfs/ps diagnostics, ssh heredocs that
expand local config) get justified targeted disables.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

perf/shellcheck.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# shellcheck.sh - permanent wrapper to lint every shell script in this project.
+# Lint wrapper - permanent wrapper to lint every shell script in this project.
 #
 # Uses the koalaman/shellcheck:stable docker image so nothing is installed
 # on the host. Run from anywhere; lints scripts/ and any .sh under switches/.
@@ -45,7 +45,7 @@ echo
 # Make paths relative to ROOT so docker volume maps cleanly
 REL_TARGETS=()
 for t in "${TARGETS[@]}"; do
-    rel="${t#$ROOT/}"
+    rel="${t#"$ROOT"/}"
     [ "$rel" = "$t" ] && rel="$t"
     REL_TARGETS+=("$rel")
 done
@@ -61,5 +61,5 @@ if [ "$STRICT" -eq 1 ]; then
     exit $RC
 fi
 # Non-strict: only fail on parse errors / errors, not style notes.
-# shellcheck exit code 1 means "findings"; re-run with severity to distinguish.
+# (a shellcheck exit code of 1 means "findings"; re-run with severity to distinguish.)
 exit 0