chore: enforce shellcheck across the repo

Establish shellcheck as a mandatory pre-commit quality gate and bring all 93
shell scripts to a clean state.

- tests/shellcheck.sh: wrapper that runs koalaman/shellcheck:stable via Docker
  (no native binary needed), skips vendored + upstream librenms-agent scripts.
- .shellcheckrc: documents intentional codebase-wide disables (dynamic source
  paths SC1090/SC1091, client-side ssh expansion SC2029).
- AGENTS.md: new Git Policy rule mandating clean shellcheck for every shell
  script before commit.

Fixes applied (real bugs + quality): missing quote in netinfra/gather-configs.sh
(caused cascading parse errors), unquoted expansions, declare-and-assign masking,
egrep -> grep -E, $FUNCNAME array indexing, unused variable removal, cd || exit.
Intentional patterns (sourced config, sysfs/ps diagnostics, ssh heredocs that
expand local config) get justified targeted disables.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

provisioning/Project-Includes/PreflightCheck.sh

@@ -9,7 +9,7 @@ export user_check
 user_check="$(echo "$curr_user" | grep -c root)"
 
 
-if [ $user_check -ne 1 ]; then
+if [ "$user_check" -ne 1 ]; then
     print_error "Must run as root."
     error_out
 fi

provisioning/Project-Includes/pi-detect.sh

@@ -1,7 +1,7 @@
-
+# shellcheck shell=bash disable=SC2148 # sourced function file (no shebang by design)
 function pi-detect()
 {
-print_info Now running "$FUNCNAME"....
+print_info Now running "${FUNCNAME[0]}"....
 if [ -f /sys/firmware/devicetree/base/model ] ; then
 export IS_RASPI="1"
 fi
@@ -9,5 +9,5 @@ fi
 if [ ! -f /sys/firmware/devicetree/base/model ] ; then
 export IS_RASPI="0"
 fi
-print_info Completed running "$FUNCNAME"
+print_info Completed running "${FUNCNAME[0]}"
 }