chore(gate): shellcheck joins the gate — every tracked shell script, the host binary held to a pin

docs/development.md

@@ -87,6 +87,13 @@ docker compose -f backend/docker-compose.test.yml run --rm --no-deps test \
   pip-audit -r requirements.lock --no-deps --disable-pip
 ```
 
+**Shell scripts**
+
+```bash
+# every tracked *.sh at shellcheck's default bar (info included); the version is pinned in scripts/check.sh
+git ls-files -z -- '*.sh' | xargs -0 shellcheck
+```
+
 A missing database or ffmpeg is a hard error, not a skip — so the gate can't print green while the
 DB-backed tests were quietly not run (`SIFTLODE_TEST_REQUIRE_DB=0` is the explicit "pure-logic only"
 run for a machine without Postgres). Tests that need a database take the `db` fixture