chore(gate): shellcheck joins the gate — every tracked shell script, the host binary held to a pin

frontend/src/lib/gates.snapshot.json

@@ -1377,6 +1377,16 @@
       "}",
       "ruff_check() { ruff_pinned && python -m ruff check --config backend/ruff.toml backend scripts; }",
       "ruff_format() { ruff_pinned && python -m ruff format --check --config backend/ruff.toml backend scripts; }",
+      "SHELLCHECK_PIN=0.11.0",
+      "shellcheck_lane() {",
+      "  local host",
+      "  host=\"$(shellcheck --version 2>/dev/null | sed -n 's/^version: //p')\"",
+      "  if [ \"$host\" != \"$SHELLCHECK_PIN\" ]; then",
+      "    echo \"shellcheck ${host:-missing} on the host, $SHELLCHECK_PIN pinned — https://github.com/koalaman/shellcheck/releases\" >&2",
+      "    return 1",
+      "  fi",
+      "  git ls-files -z -- '*.sh' | xargs -0 shellcheck",
+      "}",
       "basedpyright() {",
       "  local before",
       "  before=\"$(git hash-object backend/.basedpyright/baseline.json)\"",
@@ -1394,6 +1404,7 @@
       "gate_t0=\"$(ms)\"",
       "lane \"ruff\" ruff_check",
       "lane \"ruff format --check\" ruff_format",
+      "lane \"shellcheck (every shell script)\" shellcheck_lane",
       "lane \"basedpyright (new errors only)\" basedpyright",
       "lane \"lock check (frontend/node_modules == package-lock.json)\" node scripts/check-node-modules.mjs",
       "lane \"tsc (src + configs + e2e)\" frontend npm run --silent typecheck",
@@ -1405,7 +1416,7 @@
       "  local rc=0",
       "  docker compose -f \"$TESTCOMPOSE\" up --build --abort-on-container-exit --exit-code-from test || rc=1",
       "  docker compose -f \"$TESTCOMPOSE\" down -v >/dev/null 2>&1",
-      "  return $rc",
+      "  return \"$rc\"",
       "}",
       "pip_audit() {",
       "  docker compose -f \"$TESTCOMPOSE\" run --rm --no-deps test \\",