chore: enforce shellcheck across the repo

Establish shellcheck as a mandatory pre-commit quality gate and bring all 93
shell scripts to a clean state.

- tests/shellcheck.sh: wrapper that runs koalaman/shellcheck:stable via Docker
  (no native binary needed), skips vendored + upstream librenms-agent scripts.
- .shellcheckrc: documents intentional codebase-wide disables (dynamic source
  paths SC1090/SC1091, client-side ssh expansion SC2029).
- AGENTS.md: new Git Policy rule mandating clean shellcheck for every shell
  script before commit.

Fixes applied (real bugs + quality): missing quote in netinfra/gather-configs.sh
(caused cascading parse errors), unquoted expansions, declare-and-assign masking,
egrep -> grep -E, $FUNCNAME array indexing, unused variable removal, cd || exit.
Intentional patterns (sourced config, sysfs/ps diagnostics, ssh heredocs that
expand local config) get justified targeted disables.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

tests/validation/dns-ntp-redundancy.sh

@@ -6,8 +6,6 @@
 
 set -euo pipefail
 
-PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
-
 # The authoritative pair (pfv-netinfra-01 / pfv-netinfra-02).
 DNS_PRIMARY="192.168.3.252"
 DNS_SECONDARY="192.168.3.253"
@@ -20,7 +18,6 @@ NTP_CONF="/etc/ntpsec/ntp.conf"
 # A name every recursive resolver must be able to resolve.
 DNS_PROBE_NAME="github.com"
 
-failed=0
 have() { command -v "$1" >/dev/null 2>&1; }
 
 # --- Configuration assertions -------------------------------------------------

tests/validation/system-requirements.sh

@@ -12,7 +12,8 @@ REQUIRED_COMMANDS=("curl" "wget" "git" "systemctl" "apt-get")
 
 # Test functions
 function test_memory_requirements() {
-    local total_mem_kb=$(grep MemTotal /proc/meminfo | awk '{print $2}')
+    local total_mem_kb
+    total_mem_kb=$(grep MemTotal /proc/meminfo | awk '{print $2}')
     local total_mem_gb=$((total_mem_kb / 1024 / 1024))
     
     if [[ $total_mem_gb -ge $MIN_RAM_GB ]]; then
@@ -25,7 +26,8 @@ function test_memory_requirements() {
 }
 
 function test_disk_space() {
-    local available_gb=$(df / | tail -1 | awk '{print int($4/1024/1024)}')
+    local available_gb
+    available_gb=$(df / | tail -1 | awk '{print int($4/1024/1024)}')
     
     if [[ $available_gb -ge $MIN_DISK_GB ]]; then
         echo "✅ Disk space requirement met: ${available_gb}GB >= ${MIN_DISK_GB}GB"
@@ -53,8 +55,10 @@ function test_required_commands() {
 
 function test_os_compatibility() {
     if [[ -f /etc/os-release ]]; then
-        local os_id=$(grep "^ID=" /etc/os-release | cut -d'=' -f2 | tr -d '"')
-        local os_version=$(grep "^VERSION_ID=" /etc/os-release | cut -d'=' -f2 | tr -d '"')
+        local os_id
+        local os_version
+        os_id=$(grep "^ID=" /etc/os-release | cut -d'=' -f2 | tr -d '"')
+        os_version=$(grep "^VERSION_ID=" /etc/os-release | cut -d'=' -f2 | tr -d '"')
         
         case "$os_id" in
             ubuntu|debian)