chore: enforce shellcheck across the repo

Establish shellcheck as a mandatory pre-commit quality gate and bring all 93
shell scripts to a clean state.

- tests/shellcheck.sh: wrapper that runs koalaman/shellcheck:stable via Docker
  (no native binary needed), skips vendored + upstream librenms-agent scripts.
- .shellcheckrc: documents intentional codebase-wide disables (dynamic source
  paths SC1090/SC1091, client-side ssh expansion SC2029).
- AGENTS.md: new Git Policy rule mandating clean shellcheck for every shell
  script before commit.

Fixes applied (real bugs + quality): missing quote in netinfra/gather-configs.sh
(caused cascading parse errors), unquoted expansions, declare-and-assign masking,
egrep -> grep -E, $FUNCNAME array indexing, unused variable removal, cd || exit.
Intentional patterns (sourced config, sysfs/ps diagnostics, ssh heredocs that
expand local config) get justified targeted disables.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

provisioning/Modules/Auth/auth-cloudron-ldap.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+# auth-cloudron-ldap.sh — placeholder module (Cloudron LDAP auth integration).
+# Intentionally empty; populated when the auth stack is deployed.
+true

provisioning/Modules/RandD/sslStackFromSource.sh

@@ -1,4 +1,5 @@
 #!/bin/bash
+# shellcheck disable=SC2103 # legacy R&D build script; cd/cd- sequence is intentional
 
 #Made from instructions at https://www.tunetheweb.com/performance/http2/
 
@@ -24,17 +25,17 @@ CURL_FILE="curl-7.60.0.tar.gz"
 #Download and install latest version of openssl
 wget $OPENSSL_URL_BASE/$OPENSSL_FILE
 tar xzf $OPENSSL_FILE
-cd openssl-1.1.0h 
+cd openssl-1.1.0h || exit
 ./config enable-weak-ssl-ciphers shared zlib-dynamic -DOPENSSL_TLS_SECURITY_LEVEL=0 --prefix=/usr/local/custom-ssl/openssl-1.1.0h ; make ; make install
 ln -s /usr/local/custom-ssl/openssl-1.1.0h /usr/local/openssl
-cd -
+cd - || exit
 
 #Download and install nghttp2 (needed for mod_http2).
 wget $NGHTTP_URL_BASE/$NGHTTP_FILE
 tar xzf $NGHTTP_FILE
-cd nghttp2-1.31.0 
+cd nghttp2-1.31.0 || exit
 ./configure --prefix=/usr/local/custom-ssl/nghttp ; make ; make install
-cd -
+cd - || exit
 
 #Updated ldconfig so curl build
 
@@ -48,34 +49,34 @@ ldconfig
 #Download and install curl
 wget $CURL_URL_BASE/$CURL_FILE
 tar xzf curl-7.60.0.tar.gz
-cd curl-7.60.0
+cd curl-7.60.0 || exit
 ./configure --prefix=/usr/local/custom-ssl/curl --with-nghttp2=/usr/local/custom-ssl/nghttp/ --with-ssl=/usr/local/custom-ssl/openssl-1.1.0h/ ; make ; make install
-cd -
+cd - || exit
 
 
 #Download and install latest apr
 wget $APR_URL_BASE/$APR_FILE
 tar xzf $APR_FILE
-cd apr-1.6.3 
+cd apr-1.6.3 || exit
 ./configure --prefix=/usr/local/custom-ssl/apr ; make ; make install
-cd -
+cd - || exit
 
 #Download and install latest apr-util
 wget $APR_UTIL_URL_BASE/$APR_UTIL_FILE
 tar xzf apr-util-1.6.1.tar.gz
-cd apr-util-1.6.1 
+cd apr-util-1.6.1 || exit
 ./configure --prefix=/usr/local/custom-ssl/apr-util --with-apr=/usr/local/custom-ssl/apr ; make; make install
-cd -
+cd - || exit
 
 #Download and install apache
 wget $APACHE_URL_BASE/$APACHE_FILE
 tar xzf httpd-2.4.33.tar.gz
-cd httpd-2.4.33
+cd httpd-2.4.33 || exit
 cp -r ../apr-1.6.3 srclib/apr
 cp -r ../apr-util-1.6.1 srclib/apr-util
 ./configure --prefix=/usr/local/custom-ssl/apache  --with-ssl=/usr/local/custom-ssl/openssl-1.1.0h/ --with-pcre=/usr/bin/pcre-config --enable-unique-id --enable-ssl --enable-so --with-included-apr --enable-http2 --with-nghttp2=/usr/local/custom-ssl/nghttp/
 make
 make install
 ln -s /usr/local/custom-ssl/apache /usr/local/apache
-cd -
+cd - || exit
 

provisioning/Modules/Security/secharden-ssh.sh

@@ -79,7 +79,7 @@ if [ "$SUBODEV_CHECK" = 1 ]; then
 fi
 
 export DEV_WORKSTATION_CHECK
-DEV_WORKSTATION_CHECK="$(hostname | egrep -c 'subopi-dev|CharlesDevServer' || true)"
+DEV_WORKSTATION_CHECK="$(hostname | grep -Ec 'subopi-dev|CharlesDevServer' || true)"
 
 if [ "$DEV_WORKSTATION_CHECK" -eq 0 ]; then