qa: harden blacklist test process and runner boundaries

.github/workflows/deploy.yml

@@ -91,9 +91,12 @@ jobs:
       - name: Staging disk-monitor unit tests (issue #1684)
         run: bash scripts/staging/test-disk-monitor.sh
 
-      - name: QA SQL parameter-binding unit tests (issue #1977)
+      - name: QA blacklist script unit tests (issues #1977, #83)
         run: bash qa/scripts/test-blacklist-sql.sh
 
+      - name: ShellCheck QA blacklist scripts (issue #83)
+        run: shellcheck -x -P SCRIPTDIR qa/scripts/blacklist-test.sh qa/scripts/test-blacklist-sql.sh
+
       - name: Lint CSS variables (issue #1128)
         run: |
           set -e

qa/plans/v3.6.0-rc.md

@@ -95,7 +95,7 @@ Run `scripts/api-contract-diff.sh BASELINE_URL TARGET_URL` once. Report the scri
 | 10.1 | Add node pubkey to nodeBlacklist config; restart | Hidden from listings/map/neighbor graph | #742 | auto: blacklist-test.sh |
 | 10.2 | Packets still in DB | Yes (filter not delete) | #742 | auto: blacklist-test.sh |
 
-`blacklist-test.sh` covers both 10.1 and 10.2 in one run. Required env: `TEST_NODE_PUBKEY` (hex, of a real visible node on TARGET), `TARGET_SSH_HOST`, `TARGET_CONFIG_PATH`, `TARGET_CONTAINER`. Optional: `TARGET_DB_PATH` or `ADMIN_API_TOKEN` for §10.2 probe; `TARGET_SSH_KEY` (default `/root/.ssh/id_ed25519`). Mandatory teardown removes the pubkey and verifies the node returns to listings.
+`blacklist-test.sh` covers both 10.1 and 10.2 in one run. Required env: `TEST_NODE_PUBKEY` (hex, of a real visible node on TARGET), `TARGET_SSH_HOST`, `TARGET_CONFIG_PATH`, `TARGET_CONTAINER`. §10.2 is SQLite-only and needs at least one db path, each used only by its own runner: `TARGET_CONTAINER_DB_PATH` (path inside the container, for `docker exec … sqlite3`) and/or `TARGET_HOST_DB_PATH` (path on the target host, for its own `sqlite3`). The two may differ; a path that is not a non-empty file in its runner's environment fails §10.2 without creating a file. `TARGET_DB_PATH` and `ADMIN_API_TOKEN` are no longer read and make the run refuse to start. Optional: `TARGET_SSH_KEY` (default `/root/.ssh/id_ed25519`), `CURL_TIMEOUT`, `RESTART_WAIT_S`. Mandatory teardown removes the pubkey and verifies the node returns to listings. The pubkey, SQL and URLs never appear in process arguments (stdin / mode-600 files instead).
 
 ### 11. Deploy/ops
 | # | Step | Pass criteria | Source | Mode |