Add shellcheck (closes #2)

Install shellcheck from apt, which ships a current 0.11 release, and
check it in the smoke test.

Model: deepseek-v4-pro

README.md

@@ -20,6 +20,7 @@ Image: `git.eeqj.de/sneak/baseimage`, built for `linux/amd64` and
 | Go (distro)     | apt `golang-go`                | `/usr/lib/go-*`                |
 | Go (latest)     | go.dev tarball                 | `/usr/local/go`                |
 | golangci-lint   | GitHub release                 | `/usr/local/bin/golangci-lint` |
+| shellcheck      | apt                            | `/usr/bin/shellcheck`          |
 | Hugo (extended) | GitHub release `.deb`          | `/usr/local/bin/hugo`          |
 | Node (distro)   | apt `nodejs`, `npm`            | `/usr/bin/node`                |
 | nvm             | git tag                        | `/usr/local/nvm`               |

bin/test

@@ -21,6 +21,7 @@ docker run --rm "$img" bash -ec '
     COREPACK_ENABLE_NETWORK=0 yarn --version
     COREPACK_ENABLE_NETWORK=0 pnpm --version
     prettier --version
+    shellcheck --version
 '
 
 echo "== $img: runit service lifecycle"

build.sh

@@ -25,7 +25,8 @@ apt-get -y install --no-install-recommends \
     python3 python3-dev python3-pip python3-venv virtualenv \
     libbz2-dev libffi-dev libgdbm-dev liblzma-dev libncurses-dev \
     libreadline-dev libsqlite3-dev libssl-dev libxml2-dev libxmlsec1-dev \
-    tk-dev uuid-dev zlib1g-dev
+    tk-dev uuid-dev zlib1g-dev \
+    shellcheck
 
 # --- Go (latest) -------------------------------------------------------------
 gover="$(curl -fsSL 'https://go.dev/VERSION?m=text' | head -n1)"
@@ -96,6 +97,7 @@ rm -rf /root/.cache /root/.npm /root/.config /root/go /tmp/* /var/tmp/*
 # --- sanity ------------------------------------------------------------------
 go version
 golangci-lint version
+shellcheck --version
 hugo version
 node --version
 npm --version