ci: add shellcheck to CI and lefthook

[ojongerius]

Summary

• Add shellcheck.yml workflow triggered on .sh file changes
• Add shellcheck pre-commit hook to lefthook (gracefully skips if not installed)
• Matches the pattern used in the ar monorepo

Test plan

• Push a .sh file change and verify shellcheck workflow runs
• Verify lefthook runs shellcheck on staged .sh files

[Copilot]

Pull request overview

Adds ShellCheck linting to the repo via both GitHub Actions CI and a local lefthook pre-commit hook, aligning shell script linting with existing Go CI checks.

Changes:

• Add a new GitHub Actions workflow to run ShellCheck on .sh changes.
• Add a lefthook pre-commit job to run ShellCheck on staged .sh files (with a skip message if not installed).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
lefthook.yml	Adds a shellcheck pre-commit job for staged .sh files.
.github/workflows/shellcheck.yml	Introduces a CI workflow to run ShellCheck when .sh files change.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The A && shellcheck ... || echo "shellcheck not installed" construct will also hit the || echo ... branch when shellcheck is installed but returns a non-zero exit code (i.e., lint failures), causing the hook to pass and hiding real issues. Restructure this so the "skip" path only happens when shellcheck is missing, and otherwise propagate shellcheck's exit status.

Suggested change

	run: command -v shellcheck >/dev/null 2>&1 && shellcheck {staged_files} || echo "shellcheck not installed — skipping"
	run: if command -v shellcheck >/dev/null 2>&1; then shellcheck {staged_files}; else echo "shellcheck not installed — skipping"; fi

[Copilot]

The header comment says the run commands "check the entire module — not just staged files", but this new job runs shellcheck only on {staged_files}. Either update the comment to reflect this exception or adjust the command to lint all tracked .sh files for consistency.

[Copilot]

With paths: ["**/*.sh"] only, this workflow will not run when the workflow file itself is modified (or when adding/configuring ShellCheck via config files). Consider including .github/workflows/shellcheck.yml (and any ShellCheck config files you expect) in the paths list so changes to the workflow are validated in PRs.

Suggested change

	- "**/*.sh"
	pull_request:
	branches: [main]
	paths:
	- "**/*.sh"
	- "**/*.sh"
	- ".github/workflows/shellcheck.yml"
	pull_request:
	branches: [main]
	paths:
	- "**/*.sh"
	- ".github/workflows/shellcheck.yml"