feat: add variadic-args lint rule

[olavostauros]

Summary

Adds lint:variadic-args rule that detects dangerous consumption of variadic #USAGE directive values in .mise/tasks/* files (implements issue #21).

Detection

Two-phase file-scan with per-file context:

1. Phase 1 — Parse #USAGE arg ... var=#true and #USAGE flag ... var=#true directives to identify variadic env var names (usage_args, usage_foo_bar)
2. Phase 2 — Scan body lines for dangerous patterns:
   • eval "ARRAY=(\${usage_X:-})" → ERROR: shell injection vector
   • read -ra ARRAY <<< "$usage_X" → WARN: loses quoting on multi-word values

Non-variadic vars are never flagged (zero false positives verified).

Correct pattern (per mise-conventions.md)

The rule suggests the xargs printf pattern for bash and shlex.split() for Python tasks.

Files added

File	Description
.mise/tasks/lint/variadic-args	New lint rule (~240 lines)
test/lint/variadic-args/variadic-args.bats	20 BATS tests
test/lint/variadic-args/fixtures/	9 fixture directories (clean, dirty-eval, dirty-read-ra, no-variadic, mixed, ignored-file, ignored-inline, multi-task, no-tasks)

Validation

• ✅ 238/238 tests pass (218 pre-existing + 20 new, zero regressions)
• ✅ Self-hosting: codebase lint:variadic-args . — all 15 codebase task files clean
• ✅ ShellCheck: Clean with standard exclusions
• ✅ Whitespace: git diff --check — no errors

Closes #21