Harden Linux installer: stop bin-dir wipe, fix unparseable script, ARM, portability

.gitattributes

@@ -1,3 +1,7 @@
-*.ps1 -text diff
-*.sh -text diff
-*.cmd -text diff
+# Shell scripts MUST be LF: they run on Linux/macOS/WSL and are served raw via
+# `curl | bash`. CRLF here makes bash choke on the trailing \r.
+*.sh text eol=lf
+
+# Windows scripts keep CRLF.
+*.ps1 text eol=crlf diff
+*.cmd text eol=crlf

.github/workflows/lint.yml

@@ -0,0 +1,25 @@
+name: Lint
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  shell:
+    name: Shell scripts parse + shellcheck
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      # Regression guard: install.sh once shipped unparseable (broken line
+      # continuations). `bash -n` catches that class before it merges.
+      - name: bash -n (syntax check)
+        run: |
+          bash -n install.sh
+          bash -n cli/clawde.sh
+
+      - name: shellcheck
+        run: |
+          sudo apt-get update && sudo apt-get install -y shellcheck
+          shellcheck --severity=error install.sh cli/clawde.sh