Add shellcheck to pre-commit, Claude Code lint hook, and CI

[ojongerius]

Summary

• Adds shellcheck job to Lefthook pre-commit (graceful skip if not installed)
• Adds *.sh case to Claude Code lint-on-edit hook (graceful skip if not installed)
• Adds .github/workflows/shellcheck.yml — path-filtered CI check that hard-fails on shellcheck violations
• Three layers: Lefthook (local), Claude Code hook (agent edits), CI (enforced)

Verified: all .claude/hooks/*.sh scripts pass shellcheck as-is.

[Copilot]

Pull request overview

Adds ShellCheck-based linting for shell scripts to the repo’s local automation, ensuring *.sh files are checked both during git pre-commit and after Claude edits.

Changes:

• Add a shellcheck job to Lefthook pre-commit for staged *.sh files.
• Extend the Claude lint-on-edit hook to run shellcheck when editing *.sh files.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
lefthook.yml	Adds a new pre-commit job to run shellcheck on staged shell scripts.
.claude/hooks/lint-on-edit.sh	Runs shellcheck after Claude edits shell scripts (when available).

[Copilot]

The new pre-commit job will fail on developer machines/CI where shellcheck isn’t installed (unlike the Claude lint hook, which silently skips when missing). Consider either (a) guarding the lefthook command with a command -v shellcheck check and a clear skip message, or (b) documenting/enforcing shellcheck as a required dev dependency so the behavior is consistent across tooling.

Suggested change

	run: shellcheck {staged_files}
	run: if command -v shellcheck >/dev/null 2>&1; then shellcheck {staged_files}; else echo "Skipping shellcheck: 'shellcheck' is not installed."; fi

[Copilot]

This hook skips shell linting entirely when shellcheck isn’t installed, but the new lefthook.yml pre-commit job will fail in that situation. To avoid confusing/contradictory behavior, consider aligning the policy (either require shellcheck in both places, or have both skip with a clear message when it’s missing).

Suggested change

	shellcheck "$FILE_PATH" >&2 || { echo "shellcheck: $FILE_PATH has issues" >&2; exit 2; }
	shellcheck "$FILE_PATH" >&2 || { echo "shellcheck: $FILE_PATH has issues" >&2; exit 2; }
	else
	echo "shellcheck: required to lint $FILE_PATH but is not installed" >&2
	exit 2