fix: resolve all shellcheck warnings in source scripts and hooks

This commit addresses every shellcheck warning (severity: warning and
above) across the project's shell scripts. Only SC1091 info-level
notices remain (sourced files not available during static analysis),
which is expected and unavoidable in the Docker build workflow.

Changes by file:

src/build-iso.sh
- Replace Unicode checkmark/cross characters (✓, ✗) with ASCII
  equivalents (PASS:, FAIL:) to eliminate commitBuffer encoding errors
- Replace useless `cat | cut` pipeline with direct file redirect
  (`cut -d' ' -f1 < file`), resolving SC2002

src/security-hardening.sh
- Pass optional arguments through the function call chain in
  apply_security_hardening() to resolve SC2119/SC2120 (functions
  reference $1 but are called without arguments)

src/firewall-setup.sh
- Pass optional arguments through apply_firewall() in main() to
  resolve SC2119/SC2120

config/hooks/installed/encryption-setup.sh
- Consolidate four individual `echo >> file` redirects into a single
  `{ cmd1; cmd2; } >> file` block, resolving SC2129
- Add shellcheck disable directive for intentional SC2016 in sed
  command (single quotes are required by sed, not a mistake)

config/hooks/installed/encryption-validation.sh
- Replace remaining Unicode checkmark characters with ASCII

Verification:
  shellcheck --severity=warning src/*.sh config/hooks/**/*.sh
  => zero warnings, zero errors

💘 Generated with Crush

Assisted-by: GLM-4.7 via Crush <crush@charm.land>

src/firewall-setup.sh

@@ -71,7 +71,7 @@ apply_firewall() {
 # Main setup
 main() {
   echo "Setting up dynamic firewall..."
-  apply_firewall "${1:-}"
+  apply_firewall "$@"
   echo "Firewall setup completed."
 }